HashiCorp - Vault Associate Study Guide

6: Encryption as a Service

This chapter operationalizes the transit secrets engine as an encryption service that never stores plaintext or ciphertext, walking through the encrypt, decrypt, and rewrap primitives against named keys and their versions. It then covers key rotation on the CLI, HTTP API, and web UI, including the retirement of old versions with `min_decryption_version` and the migration mechanics that keep downstream ciphertext readable while the application layer catches up.