Scripts to encrypt and decrypt a file

kms-decrypt.sh

#!/bin/bash
set -euo pipefail

echoerr() { echo "$@" 1>&2; }

if [[ $# -ne 1 ]]; then
  echoerr "Usage: $0 file"
  exit 1
fi

readonly ciphertextPath="$(pwd)/$1"
readonly plaintextPath="$(dirname $ciphertextPath)/$(basename $ciphertextPath .enc)"

echo "decrypting $ciphertextPath to $plaintextPath..."
exec aws kms decrypt \
  --ciphertext-blob "fileb://$ciphertextPath" --output text --query Plaintext \
  | base64 --decode > $plaintextPath

kms-encrypt.sh

#!/bin/bash
set -euo pipefail

echoerr() { echo "$@" 1>&2; }

if [[ $# -ne 1 ]]; then
  echoerr "Usage: $0 file"
  exit 1
fi

readonly path="$(pwd)/$1"
readonly keyId='<your kms key here>'

echo "encrypting $path to $path.enc..."
exec aws kms encrypt \
  --plaintext "fileb://$path" --output text --query CiphertextBlob \
  | base64 --decode > "$path.enc"