key management

Direct encryption hits a 4 KB wall and a shared throughput quota. Envelope encryption routes around both, and the key policy underneath is central to authorizing key use.

Vault's weakness is the single shared password, not the AES256 underneath. The senior answer covers rekey ceremonies on offboarding, encrypt_string for readable diffs, labelled vault-ids per environment, and shrinking what needs encrypting at all.