AWS KMS encrypt/decrypt from CLI

gistfile1.txt

# Get the key-id from KMS
% aws kms list-keys

# To encrypt some text:
% aws kms encrypt --key-id <KeyId> --plaintext <text to encrypt>

# To decrypt it:
% aws kms decrypt --ciphertext-blob fileb://<(echo <blob from encrypt step> | base64 -D) --output text --query Plaintext | base64 -D


###Example:

# Get the key to use
% aws kms list-keys
{
    "Keys": [
        {
            "KeyArn": "arn:aws:kms:us-east-5:12345:key/1111aa11-1881-8118-1881-118811228811", 
            "KeyId": "1111aa11-1881-8118-1881-118811228811"
        }, 
        {
            "KeyArn": "arn:aws:kms:us-east-5:12345:key/1111aa11-1881-8118-1881-118811228812", 
            "KeyId": "1111aa11-1881-8118-1881-118811228812"
        }
    ]
}

# Encrypt
% aws kms encrypt --key-id 1111aa11-1881-8118-1881-118811228811 --plaintext this_is_my_secret
{
    "KeyId": "arn:aws:kms:us-east-5:12345:key/1111aa11-1881-8118-1881-118811228812",
    "CiphertextBlob": "AQECA_very_long_stringZQ=="
}

# Decrypt
% aws kms decrypt --ciphertext-blob fileb://<(echo AQECA_very_long_stringZQ==  | base64 -D) --output text --query Plaintext | base64 -D
this_is_my_secret