Registry / aws / aws-encryption-sdk-cli

aws-encryption-sdk-cli

library4.3.0pypypi✓ verified 80d ago

Command line tool for encrypting and decrypting files and directories using the AWS Encryption SDK. Current version: 4.3.0. Release cadence: irregular, major versions follow AWS Encryption SDK updates.

aws auth-security

pip install aws-encryption-sdk-cli

package ↗homepage ↗

INSTALL

IMPORT

SIG · AWS-ENCRYPTION-SDK

aws-encryption-sdk-cli

awspythonv4.3.0

Install

5.6s avg

Import

—

Disk

72MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v4.3.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 69.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 5.6s · import 0.000s · 70MB

72MB installed

● package 72MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

AWSEncryptionSDKCLIError

✓ from aws_encryption_sdk_cli import AWSEncryptionSDKCLIError

✗ from aws_encryption_sdk_cli import encrypt_file

cli

✓ from aws_encryption_sdk_cli import cli

✗ from aws_encryption_sdk_cli import encrypt_file

build_crypto_materials_manager_from_args

✓ from aws_encryption_sdk_cli import build_crypto_materials_manager_from_args

✗ from aws_encryption_sdk_cli import encrypt_file

Basic encrypt/decrypt commands using AWS KMS. Requires AWS credentials configured.

# Encrypt a file with a KMS key # Replace KEY_ARN and INPUT_FILE with your values aws-encryption-sdk-cli encrypt --input /path/to/plaintext --output /path/to/ciphertext --master-keys key=arn:aws:kms:us-east-1:123456789012:key/abc123 # Decrypt the file aws-encryption-sdk-cli decrypt --input /path/to/ciphertext --output /path/to/plaintext

aws-encryption-sdk-cli --version

Debug

Known issues

breakingVersion 4.0.0+ changed the CLI interface: removed --encode and --decode flags; encryption format changed to AWS Encryption SDK 2.0+ (message format v2). Existing encrypted data from v1.x SDK will not be decryptable unless migration steps are taken.

fix

Use aws-encryption-sdk-cli v3.x for backward compatibility, or re-encrypt data using new CLI.

affects: >=4.0.0

deprecatedThe --master-keys flag is deprecated in favor of --wrapping-keys in v4.x. Old flag still works but may be removed.

fix

Replace --master-keys with --wrapping-keys in commands.

affects: >=4.0.0

gotchaThe CLI tool requires write permissions to the output directory. If output file exists, it will be overwritten without warning.

fix

Ensure output directory exists and use a unique filename to avoid accidental overwrites.

affects: all

gotchaWhen using --input and --output for directories, the CLI encrypts/decrypts each file individually and preserves directory structure. However, files larger than available memory may fail because the SDK buffers entire files.

fix

For large files, use streaming options or split files before encryption.

affects: all

Upgrade

Version history

4.3.0latest on PyPI · released Nov 27, 2025

Audit

Dependencies

aws-encryption-sdkrequiredCore dependency, provides the encryption/decryption operations

boto3requiredRequired for AWS KMS integration and credential resolution

Agent activity

28 hits · last 30 days

node

OpenAI (training)

Resources

packagehttps://pypi.org/project/aws-encryption-sdk-cli/ ↗

homepagehttp://aws-encryption-sdk-cli.readthedocs.io/en/latest/ ↗