Self-service device encryption key access

A non-transitory computer-readable medium embodying program instructions executable in a computing device that, when executed by the computing device, cause the computing device to at least:

• generate a first recovery key from an encryption of a data store associated with the computing device;
• transmit to a management service the first recovery key in an instance in which the data store has been encrypted;
• decrypt the encrypted data store based on an input of the first recovery key to the computing device;
• retrieve a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;
• generate a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key;
• and
• transmit the second recovery key to the management service.

A computer-implemented method, comprising:

• generating a first recovery key from an encryption of a data store associated with a computing device;
• transmitting to a management service the first recovery key in an instance in which the data store has been encrypted;
• decrypting the encrypted data store based on an input of the first recovery key to the computing device;
• retrieving a first key rotation command from a command queue of the management service, the first key rotation command including an instruction to rotate the first recovery key;
• generating a second recovery key based on rotating the first recovery key according to the instruction to rotate the first recovery key;
• and
• transmitting the second recovery key to the management service.