KMS encrypting a file on AWS

s3put-encrypt.sh

#!/bin/sh

CMD=`basename $0`
TMPFILE=`mktemp /tmp/${CMD}.XXXXXX` || exit 1
KEY_ARN="arn:aws:kms:eu-west-1:28282828282:key/2828282-82822-28283-28238-28383393"

function usage {
	echo "${CMD} [-k KMS key arn] <from> <to>" >&2
        echo " Example:"
	echo "   ${CMD} env.staging s3://bucket/staging/env.staging" >&2
	echo "   ${CMD} -k arn:aws:kms:eu-west-1:28282828282:key/2828282-82822-28283-28238-28383393 env.staging s3://bucket/staging/env.staging" >&2
	exit
}


while getopts ":k:" opt; do
  case $opt in
    k)
      KEY_ARN=$OPTARG
      ;;
    \?)
      echo "Invalid option: -$OPTARG" >&2
      usage
      ;;
    :)
      echo "Option -$OPTARG requires an argument." >&2
      usage
      ;;
  esac
done

ARGS=$@
shift $(($OPTIND - 1))

FROM=$1
TO=$2

if [ "${FROM}" = "" -o "${TO}" = "" ]; then
	usage
fi

aws kms encrypt --key-id ${KEY_ARN} --plaintext fileb://${FROM}  --output text --query CiphertextBlob > ${TMPFILE}
aws s3 cp ${TMPFILE} ${TO}
rm ${TMPFILE}