Helper to encrypt and decrypt using AWS KMS

kms_encrypt_decrypt.sh

#!/bin/bash

export PROFILE='my-security-profile'
export KEY='12345678-abcd-efgh-ijkl-1234567890'

function encrypt() {
        aws --profile "$PROFILE" \
                kms encrypt \
                --key-id "$KEY" \
                --plaintext "file://$1" \
                --output text \
                --query CiphertextBlob |\
                base64 --decode > "encrypted_$1"
}

function decrypt() {
        aws --profile "$PROFILE" \
                kms decrypt \
                --ciphertext-blob "fileb://$1" \
                --output text \
                --query Plaintext |\
                base64 --decode > "${1/encrypted_/decrypted_}"
}