aws kms encrypt
Encrypts plaintext of up to 4,096 bytes using a KMS key. AWS CLI reference
3 examples 6 options Its page in the AWS CLI reference
Examples
Example 1: To encrypt the contents of a file (Linux and macOS)
The following encrypt example demonstrates the recommended way to encrypt data with the AWS CLI.
aws kms encrypt --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 --plaintext fileb://ExamplePlaintextFile --output text --query CiphertextBlob | base64 --decode > ExampleEncryptedFileIdentify--key-idIdentifies the KMS key to use in the encryption operation.--plaintextData to be encrypted.--outputThe formatting style for command output.--queryA JMESPath query to use in filtering the response data.Trips 1 Sigma rule: lowDecode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community
The command does several things:
Uses the --plaintext parameter to indicate the data to encrypt. This parameter value must be base64-encoded.
The value of the plaintext parameter must be base64-encoded, or you must use the fileb:// prefix, which tells the AWS CLI to read binary data from the file. If the file is not in the current directory, type the full path to file. For example: fileb:///var/tmp/ExamplePlaintextFile or fileb://C:\Temp\ExamplePlaintextFile. For more information about reading AWS CLI parameter values from a file, see Loading Parameters from a File in the AWS Command Line Interface User Guide.
Uses the --output and --query parameters to control the command's output.
These parameters extract the encrypted data, called the ciphertext, from the command's output. For more information about controlling output, see Controlling Command Output in the AWS Command Line Interface User Guide.
Uses the base64 utility to decode the extracted output into binary data.
The ciphertext that is returned by a successful encrypt command is base64-encoded text. You must decode this text before you can use the AWS CLI to decrypt it.
Saves the binary ciphertext to a file.
The final part of the command (> ExampleEncryptedFile) saves the binary ciphertext to a file to make decryption easier. For an example command that uses the AWS CLI to decrypt data, see the decrypt examples.
This command produces no output.
Example 2: To encrypt the contents of a file (Windows)
The following encrypt example is the same as the previous one, except that it uses the certutil tool instead of base64. This procedure requires two commands, as shown in the following example.
aws kms encrypt ^Identify--key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 ^--plaintext fileb://ExamplePlaintextFile ^--output text ^--query CiphertextBlob > C:\Temp\ExampleEncryptedFile.base64This command produces no output. The base64-encoded ciphertext is saved to C:\Temp\ExampleEncryptedFile.base64.
Run the certutil command.
certutil -decode C:\Temp\ExampleEncryptedFile.base64 C:\Temp\ExampleEncryptedFileThe ciphertext is saved to C:\Temp\ExampleEncryptedFile.
Example 3: To encrypt the contents of a file with an asymmetric KMS key
The following encrypt example shows how to encrypt plaintext with an asymmetric KMS key. The --encryption-algorithm parameter is required. As in all encrypt CLI commands, the plaintext parameter must be base64-encoded, or you must use the fileb:// prefix, which tells the AWS CLI to read binary data from the file.
aws kms encrypt --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 --encryption-algorithm RSAES_OAEP_SHA_256 --plaintext fileb://ExamplePlaintextFile --output text --query CiphertextBlob | base64 --decode > ExampleEncryptedFileIdentify--key-idIdentifies the KMS key to use in the encryption operation.--encryption-algorithmSpecifies the encryption algorithm that KMS will use to encrypt the plaintext message.--plaintextData to be encrypted.--outputThe formatting style for command output.--queryA JMESPath query to use in filtering the response data.Trips 1 Sigma rule: lowDecode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community
This command produces no output.
Options
--dry-runChecks if your request will succeed.--encryption-algorithmSpecifies the encryption algorithm that KMS will use to encrypt the plaintext message.--encryption-contextSpecifies the encryption context that will be used to encrypt the data.--grant-tokensA list of grant tokens.--key-idIdentifies the KMS key to use in the encryption operation.--plaintextData to be encrypted.