The AWS Encryption SDK for Python provides a fully compliant, native Python implementation of the AWS Encryption SDK. It is a client-side encryption library designed to simplify data encryption and decryption using industry standards and best practices, employing envelope encryption. The library is actively maintained with regular patch and minor releases, typically quarterly, and less frequent major version updates.
Install & Compatibility
Where this runs
tested against v4.0.6 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.950 runs
installs and imports cleanly · install 0.0s · import 1.722s · 69.5MB
glibcpy 3.10–3.950 runs
installs and imports cleanly · install 5.5s · import 1.642s · 70MB
78MB installed
● package 78MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
from aws_encryption_sdk import EncryptionSDKClient
from aws_encryption_sdk import CommitmentPolicy
Keyrings are now provided by the `aws-cryptographic-material-providers-library` (MPL) in v4, replacing older direct imports from `aws_encryption_sdk.keyrings`. The MPL is implicitly installed with `aws-encryption-sdk[MPL]`.
from aws_cryptographic_material_providers.kms import KmsKeyring as AwsKmsKeyring
Master key providers are legacy components and have been superseded by keyrings provided by the AWS Cryptographic Material Providers Library (MPL) in v4. Migration to keyring interfaces is recommended.
from aws_cryptographic_material_providers.kms import KmsKeyring as AwsKmsKeyring # Use Keyrings instead
This quickstart demonstrates how to encrypt and decrypt a simple byte string using the AWS Encryption SDK for Python with an AWS KMS Keyring. It leverages the recommended `aws-cryptographic-material-providers-library` for keyring management and sets the default `CommitmentPolicy`. Remember to replace placeholder values with your actual AWS KMS Key ARN and Account ID, and ensure your environment has appropriate AWS credentials configured.
import os
from aws_encryption_sdk import EncryptionSDKClient, CommitmentPolicy
from aws_cryptographic_material_providers.kms import KmsKeyring # from aws_cryptographic_material_providers.mpl import AwsCryptographicMaterialProviders, CreateAwsKmsKeyringInput, AwsKmsKeyring
# NOTE: Replace with your actual KMS Key ARN and AWS Account ID
KMS_KEY_ARN = os.environ.get('AWS_KMS_KEY_ARN', 'arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd-1234-abcd-1234-abcd1234abcd')
AWS_ACCOUNT_ID = os.environ.get('AWS_ACCOUNT_ID', '111122223333')
# 1. Instantiate the encryption SDK client with the default commitment policy.
client = EncryptionSDKClient(commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT)
# 2. Create a KMS Keyring. In production, ensure appropriate IAM permissions.
keyring = KmsKeyring(key_ids=[KMS_KEY_ARN])
# 3. Define your plaintext and encryption context
plaintext = b"my secret data"
encryption_context = {
"purpose": "test",
"origin": "us-west-2"
}
# 4. Encrypt the data
ciphertext, header = client.encrypt(
source=plaintext,
keyring=keyring,
encryption_context=encryption_context
)
print(f"Ciphertext: {ciphertext.hex()}")
# 5. Decrypt the data using the same keyring (or a compatible one).
# For decryption, the KMS Keyring will attempt to decrypt the data key using KMS.
decrypted_plaintext, header = client.decrypt(
source=ciphertext,
keyring=keyring,
encryption_context=encryption_context # Context validated only if using MPL CMM
)
print(f"Decrypted plaintext: {decrypted_plaintext.decode()}")
# 6. Verify that the decrypted plaintext is identical to the original plaintext.
assert plaintext == decrypted_plaintext
print("Encryption and decryption successful!")
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.