anchor.diff:  
   In order to rotate an encryption key:
   
  -1. Add a new encryption key to the list of `keys` (e.g. `encyption_key_1` below).
  -1. Update the `current_key_label` to be the label of the new encryption key (e.g. updating the `current_key_label` to be `"encryption_key_1"` below).
  +1. Add a new encryption key to the list of `keys` (e.g. `<%= rotated_key %>` below).
  +1. Update the `current_key_label` to be the label of the new encryption key (e.g. updating the `current_key_label` to be `"<%= rotated_key %>"` below).
   
       The following is an example of an ops file used for rotation:
   
  
positive.code:   path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/database_encryption?
    value: &encryption_info
      keys:
        encryption_key_0: "example-random-key-string"
      current_key_label: "encryption_key_0"
  
  - type: replace
    path: /instance_groups/name=cc-worker/jobs/name=cloud_controller_worker/properties/cc/database_encryption?
  
negative.code: 
  1. Choose a value for the encryption key (e.g. `"example-random-key-string"`).
  
  1. Choose a label for the encryption key (e.g. `<%= encryption_key %>`). The label must abide by the following restrictions:
    * 127 character limit
    * Cannot contain a `:` (colon)
  
  1. Format the encryption key values into YAML as follows:
  
      ```
      current_key_label: "<%= encryption_key %>"
      keys:
        <%= encryption_key %>: "example-random-key-string"
      ```
  
      <p class='note'><strong>Note</strong>: If your CC instance groups have the <code>db_encryption_key</code> key, make sure that the
      <code>db_encryption_key</code> is added into the <code>keys</code> block, and that its corresponding key label is set to be the <code>current_key_label</code>.
      For example:</p>
  
      ```
      db_encryption_key: "example-random-key-string"
      current_key_label: "<%= encryption_key %>"
      keys:
        <%= encryption_key %>: "example-random-key-string"
      ```
  
  1. Make the changes by either creating and applying an [ops file](#configuring-via-ops-file) or directly modifying the [manifest](#configuring-via-manifest).
  
  1. Deploy the changes with the following command.
  
      <pre class='terminal'>
      # With an ops file
      $ bosh deploy -o YOUR_OPS_FILE_NAME PATH_TO_YOUR_MANIFEST
  
      # Directly modifying the manifest
      $ bosh deploy PATH_TO_YOUR_MANIFEST
      </pre>
  
  1. Run the bosh errand to encrypt the fields.
  
  