Based on the recent announcement, I started to dig into the BYOK encryption.
I noticed the IAM role that customers apply to allow access to their KMS keys doesn't include kms:Encrypt or kms:Decrypt operations.
(protip: constrain that policy to only the keys you want to allow Atlassian to access, unlike the "*" it is by default)
Not having the encrypt or decrypt operations suggests to me that Atlassian is importing the key material, keeping a copy for themselves, and periodically checking KMS if the key has been invalidated.
Has anyone played with this enough to understand how it's operating?
