sensitive_value.rb

class SensitiveValue
  attr_reader :value, :encrypted_value

  def initialize(value)
    @value = value
  end

  def encrypt
    bin = value.unpack("B*")
    encoded_bin = Base64.encode64(bin[0])
    resp = client.encrypt(
      key_id: ENV.fetch("AWS_CMK_IDENTIFIER"),
      plaintext: encoded_bin
    )
    @encrypted_value = resp.to_h[:ciphertext_blob]
  end

  def decrypt
    bin = Base64.decode64(encrypted_value)
    # Returns a base64 encoded plaintext string
    resp = client.decrypt(ciphertext_blob: [bin].pack("B*"))
    resp.plaintext
  end

  private

  def client
    # NOTE: see config/initializers/aws.rb for configuration details.
    @client ||= Aws::KMS::Client.new
  end
end