Decrypt/Encrypt Using AWS and CLI

aws kms decrypt-encrypt.md

Encryption

aws kms encrypt --key-id <kms-id> \
--profile default \
--plaintext fileb://input_file.txt \
--query CiphertextBlob \
--output text \
	| base64 --decode > output.enc

Decryption

aws kms decrypt --ciphertext-blob fileb://output.enc  \
--output text  --query Plaintext  --region us-east-2 | base64 -D > decrypted.txt

Setup

• set up aws client via aws configure
• user for that set up doesn't need any IAM rights, but must be assigned as a key user