Comment 2 for bug 1714157

If it's AES and symmetric crypto in general you bet it must be the same on every stateless service instance.

https://github.com/openstack/heat/blob/stable/pike/heat/common/crypt.py#L37
https://github.com/openstack/heat/blob/stable/pike/doc/source/configuration/tables/heat-crypt.rst

I encountered this bug myself but haven't reported it. Heat is not usable without this in the HA configuration.