aws-encryption-sdk

import os from aws_encryption_sdk import EncryptionSDKClient, CommitmentPolicy from aws_cryptographic_material_providers.kms import KmsKeyring # from aws_cryptographic_material_providers.mpl import AwsCryptographicMaterialProviders, CreateAwsKmsKeyringInput, AwsKmsKeyring # NOTE: Replace with your actual KMS Key ARN and AWS Account ID KMS_KEY_ARN = os.environ.get('AWS_KMS_KEY_ARN', 'arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd-1234-abcd-1234-abcd1234abcd') AWS_ACCOUNT_ID = os.environ.get('AWS_ACCOUNT_ID', '111122223333') # 1. Instantiate the encryption SDK client with the default commitment policy. client = EncryptionSDKClient(commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT) # 2. Create a KMS Keyring. In production, ensure appropriate IAM permissions. keyring = KmsKeyring(key_ids=[KMS_KEY_ARN]) # 3. Define your plaintext and encryption context plaintext = b"my secret data" encryption_context = { "purpose": "test", "origin": "us-west-2" } # 4. Encrypt the data ciphertext, header = client.encrypt( source=plaintext, keyring=keyring, encryption_context=encryption_context ) print(f"Ciphertext: {ciphertext.hex()}") # 5. Decrypt the data using the same keyring (or a compatible one). # For decryption, the KMS Keyring will attempt to decrypt the data key using KMS. decrypted_plaintext, header = client.decrypt( source=ciphertext, keyring=keyring, encryption_context=encryption_context # Context validated only if using MPL CMM ) print(f"Decrypted plaintext: {decrypted_plaintext.decode()}") # 6. Verify that the decrypted plaintext is identical to the original plaintext. assert plaintext == decrypted_plaintext print("Encryption and decryption successful!")