Here is a high-level diagram that illustrates the components involved in theses Unicreds commands:
We start this recipe by creating the key that will be used to encrypt the secrets in KMS. Note that we never get to see this key—it only exists in KMS. All you can do is request that KMS encrypts or decrypts data with it for you.
It is possible to import your own key in to KMS (so that you could decrypt the secrets outside of AWS if you needed to), but this is not required for Unicreds to work. The create-key command returns the GUID for the key, which will be used in the following steps.
Aliases make it much easier to deal with ...
