* The AWS access keys for the IAM user the tool uses, which can be rotated, revoked, recreated, etc...
* The per-disk encryption key, which can be deleted from DynamoDB
* The KMS CMK, which can be deleted, disabled, etc...
I mainly wanted to solve having to plug in a keyboard and type something in, or having a key on a USB stick and be diligent enough to take it out of the home.
* `grant-computer` creates a KMS grant as per http://docs.aws.amazon.com/kms/latest/developerguide/grants.... . `revoke-computer` removes the grant without touching the keys.
* The AWS access keys for the IAM user the tool uses, which can be rotated, revoked, recreated, etc...
* The per-disk encryption key, which can be deleted from DynamoDB
* The KMS CMK, which can be deleted, disabled, etc...
I mainly wanted to solve having to plug in a keyboard and type something in, or having a key on a USB stick and be diligent enough to take it out of the home.