Encrypt and Decrypt Data with KMS and Data Keys

Learn how to encrypt and decrypt data with KMS keys and with Data Keys

https://cybr.com ↗ Christophe Limpalair ↗

Symmetric Encryption/Decryption

Encrypting Plaintext

You can take plaintext (regular data like what you’re reading right now) and pass it through an encryption algorithm with a KMS Key in order to get ciphertext (encrypted data) back, all without leaving the Key Management Service (KMS) when dealing with smaller data.

Encrypting Plaintext

By default, when you create a new AWS KMS key, you receive a symmetric encryption KMS key. Symmetric encryption uses the same key to both encrypt and decrypt data.

KMS symmetric keys allow for data encryption up to 4096 bytes in size. The data is sent to KMS, it gets encrypted, and then it gets sent back to the sender which could be a service, application, or yourself. In this case, the encryption key never leaves KMS. If you need to encrypt larger data, see →

Encrypt plaintext data using a KMS key:

aws kms encrypt --key-id alias/lab-key --profile cybrkmslab \
  --plaintext fileb://plaintext_favorite_dog.txt \
  --output text --query CiphertextBlob | \
  base64 --decode > encrypted_favorite_dog.txt

Decrypt ciphertext that was encrypted by a KMS key:

aws kms decrypt --key-id alias/lab-key --profile cybrkmslab \
  --ciphertext-blob fileb://encrypted_favorite_dog.txt \
  --output text --query Plaintext | \
  base64 --decode > decrypted_favorite_dog.txt

Encrypting data greater than 4096 bytes in size

When data larger than 4096 bytes needs to be encrypted, KMS can generate a data key. This data key leaves KMS and is sent back to the sender. The sender is then responsible for managing the security of the key.

The data key that you receive is encrypted with a KMS key and you use the decrypted (plaintext) data key to encrypt data. You can then immediately discard it after use since you can retrieve it at a later time for decryption purposes.

Envelope encryption with a data key

Generate data key:

aws kms generate-data-key \
  --key-id alias/lab-key \
  --key-spec AES_256 --profile kmslab

Outputs:
• CiphertextBlob → encrypted_text
• Plaintext → plaintext_key

Encrypt file:

KEY_HEX=$(xxd -p -c 256 plaintext_key)
IV=$(openssl rand -hex 16) && echo $IV > iv.txt

Encrypt file:

openssl enc -aes-256-cbc \
  -K $KEY_HEX -iv $IV \
  -in file.txt -out encrypted_file.txt

rm plaintext_key

- or -

Using the AWS Encryption SDK

Encrypt using the AWS Encryption SDK CLI:

aws-encryption-cli --encrypt \
  --input plaintext_sdk_example.txt \
  --output encrypted_sdk_example.txt \
  --wrapping-keys key=key-arn-value-here profile=cybrkmslab \
  --commitment-policy require-encrypt-require-decrypt \
  --metadata-output metadata

Decrypt using the AWS Encryption SDK CLI:

aws-encryption-cli --decrypt \
  --input encrypted_sdk_example.txt \
  --output decrypted_sdk_example.txt \
  --wrapping-keys key=key-arn-value-here profile=kmslab \
  --metadata-output metadata --max-encrypted-data-keys 1 \
  --buffer --commitment-policy require-encrypt-require-decrypt

🧪 Learn KMS By Doing

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Encrypt and Decrypt Data with KMS and Data Keys
Source: https://cybr.com/cheat-sheets/kms-encryption-data-keys/

My goal: Help me implement encryption

Help me implement encryption and decryption with KMS. Ask about my data size, runtime, AWS profile, key, and intended use. Choose direct KMS encryption or envelope encryption, provide a complete worked example, and verify the decrypted output. Explain binary/base64 handling and the plaintext versus encrypted data key. Identify gaps in the illustrative OpenSSL example, including authentication and key handling, and use a maintained encryption SDK where appropriate.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "subtitle": "Learn how to encrypt and decrypt data with KMS keys and with Data Keys",
  "plaintext": "You can take plaintext (regular data like what you’re reading right now) and pass it through an encryption algorithm with a KMS Key in order to get ciphertext (encrypted data) back, all without leaving the Key Management Service (KMS) when dealing with smaller data.",
  "symmetric": "By default, when you create a new AWS KMS key, you receive a symmetric encryption KMS key. Symmetric encryption uses the same key to both encrypt and decrypt data.",
  "limit": "KMS symmetric keys allow for data encryption up to 4096 bytes in size. The data is sent to KMS, it gets encrypted, and then it gets sent back to the sender which could be a service, application, or yourself. In this case, the encryption key never leaves KMS. If you need to encrypt larger data, see →",
  "larger": "When data larger than 4096 bytes needs to be encrypted, KMS can generate a data key. This data key leaves KMS and is sent back to the sender. The sender is then responsible for managing the security of the key.",
  "dataKey": "The data key that you receive is encrypted with a KMS key and you use the decrypted (plaintext) data key to encrypt data. You can then immediately discard it after use since you can retrieve it at a later time for decryption purposes.",
  "encrypt": "aws kms encrypt --key-id alias/lab-key --profile cybrkmslab \\\n  --plaintext fileb://plaintext_favorite_dog.txt \\\n  --output text --query CiphertextBlob | \\\n  base64 --decode > encrypted_favorite_dog.txt",
  "decrypt": "aws kms decrypt --key-id alias/lab-key --profile cybrkmslab \\\n  --ciphertext-blob fileb://encrypted_favorite_dog.txt \\\n  --output text --query Plaintext | \\\n  base64 --decode > decrypted_favorite_dog.txt",
  "generate": "aws kms generate-data-key \\\n  --key-id alias/lab-key \\\n  --key-spec AES_256 --profile kmslab",
  "outputs": "Outputs:\n• CiphertextBlob → encrypted_text\n• Plaintext → plaintext_key",
  "prepare": "KEY_HEX=$(xxd -p -c 256 plaintext_key)\nIV=$(openssl rand -hex 16) && echo $IV > iv.txt",
  "openssl": "openssl enc -aes-256-cbc \\\n  -K $KEY_HEX -iv $IV \\\n  -in file.txt -out encrypted_file.txt\n\nrm plaintext_key",
  "sdkEncrypt": "aws-encryption-cli --encrypt \\\n  --input plaintext_sdk_example.txt \\\n  --output encrypted_sdk_example.txt \\\n  --wrapping-keys key=key-arn-value-here profile=cybrkmslab \\\n  --commitment-policy require-encrypt-require-decrypt \\\n  --metadata-output metadata",
  "sdkDecrypt": "aws-encryption-cli --decrypt \\\n  --input encrypted_sdk_example.txt \\\n  --output decrypted_sdk_example.txt \\\n  --wrapping-keys key=key-arn-value-here profile=kmslab \\\n  --metadata-output metadata --max-encrypted-data-keys 1 \\\n  --buffer --commitment-policy require-encrypt-require-decrypt"
}

More cheat sheets