gcloud decrypt

decrypt-secret.sh

#!/bin/bash

set -e

GCP_PROJECT="${GCP_PROJECT:-default}"
KMS_KEYRING="${KMS_KEYRING:-default}"
KMS_LOCATION="${KMS_LOCATION:-default}"
KMS_KEY="${KMS_KEY:-default}"

hash gcloud 2>/dev/null || { echo >&2 "gcloud command required to decrypt secrets."; exit 1; }

echo "Decrypting : $1"

gcloud kms decrypt --ciphertext-file=$1 --plaintext-file=${1%.enc} --key=${KMS_KEY} --keyring=${KMS_KEYRING} --location=${KMS_LOCATION}