12. Keys at rest: AWS KMS and a key for each home

This chapter has moved to one page per task.

Page	What you can do
Put the keys at rest on AWS KMS	Protect the secrets the Control Plane seals with KMS and re-seal values stored before the switch. Encrypt the AF_MASTER_KEY parameter with your own key
Give each home its own key	Seal members’ credential stores under a key of each home’s own, and know what disabling the KMS key makes unreadable
Rotate the bridge tokens	Invalidate workspace tokens for one member or for everyone at once