kms.sa-saopaulo-1.basaltic.sh. A key exists in
one region and can only be used from there, so a ciphertext produced in one
region cannot be opened in another.
Key rotation
Rotate material while keeping the same key identity and access to older ciphertext and signatures.
Creating a key
Specs, usages, and the one choice you cannot change afterwards.
Envelope encryption
What a data key is, and why you should almost never call encrypt
directly.
Signing and verifying
Algorithms per spec, and why you must not pre-hash.
Disabling and deleting
The recovery window, what cancelling gives you back, and what it does
not.
Permissions
Every IAM action, which call needs it, and how to grant sealing without
opening.
Keys other services can use
Where a key of yours can back another service’s data, and the field each
one takes.
Errors
Every error code and the state that produces it.