One thing I'm not totally clear on after reading the article is which AWS account the AWS KMS resides. Is it Slack's AWS account or the customer's?