From the docs page about key rotation (Key Rotation | Vault | HashiCorp Developer) there are two separate keys:
- internal encryption key - Encrypts and protects data written to the storage backend.
- root key - “Master” key that seals Vault and protects the internal encryption key.
Is there a way to manually and/or periodically rotate the root key?
I see that there is sys/rotate and sys/rotate/config which say thay handle “rotation of the backend encryption key”. Does this refer to the “internal encryption key” or “root key” from the list above?
Also there is /sys/rekey that deals with shares of the root key. It seems like it generates new key shares, but does this actually rotate the value of the key itself or just create new shares from which the same key can be constructed?