Encrypt and Decrypt Data with KMS and Data Keys [Cheat Sheet]

Whether you’re studying for the AWS Certified Security Specialty exam, or whether you need a way of encrypting and decrypting data to keep it safe, AWS KMS is a critical service to understand. It’s also not the easiest to wrap your head around if encryption isn’t your strong suit.

In a prior cheat sheet, we explored how to get started with the Key Management Service, but in this one let’s learn how to encrypt and decrypt data using symmetric encryption and the KMS

What is Symmetric Encryption?

Symmetric encryption uses the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext.

KMS keys

By default, when you create a KMS key, you get a symmetric key that you can use to both encrypt and decrypt data. These KMS keys are great for handling small amounts of data (less than 4096 bytes in size), and they never leave the KMS.

Once created, you can issue a command like this to encrypt plaintext:

aws kms encrypt --key-id alias/lab-key --plaintext fileb://plaintext_favorite_dog.txt --output text --query CiphertextBlob | base64 --decode > encrypted_favorite_dog.txt

…and like this to decrypt ciphertext:

aws kms decrypt --key-id alias/lab-key --ciphertext-blob fileb://encrypted_favorite_dog.txt --output text --query Plaintext | base64 --decode > decrypted_favorite_dog.txt

KMS data keys

However, KMS keys can’t be used for larger data. In that case, you can create a random KMS data key that gets enveloped by a KMS key before it leaves KMS. You can then use the plaintext data key locally to encrypt plaintext data, and later on, you can use it to decrypt its ciphertext.

The default AWS CLI can’t work with data keys directly, so you can either use something like OpenSSL or the AWS Encryption SDK. Reference the cheat sheet for more info and examples!

Want to apply this hands-on?

I created this cheat sheet to celebrate the launch of our latest Cybr 🧪 Hands-On Lab: “Encrypt and Decrypt Data with KMS and Data Keys” where you can apply and practice everything in this cheat sheet in a real AWS environment.

Cybr Premium members can access the lab here.

More information about our Hands-On Labs.

KMS Cheat Sheet

Encrypt and Decrypt Data with KMS and Data Keys

Learn how to encrypt and decrypt data with KMS keys and with Data Keys

Cybr

https://cybr.com ↗ Christophe Limpalair ↗

Symmetric Encryption/Decryption

Encrypting Plaintext

You can take plaintext (regular data like what you’re reading right now) and pass it through an encryption algorithm with a KMS Key in order to get ciphertext (encrypted data) back, all without leaving the Key Management Service (KMS) when dealing with smaller data.

Encrypting Plaintext

By default, when you create a new AWS KMS key, you receive a symmetric encryption KMS key. Symmetric encryption uses the same key to both encrypt and decrypt data.

KMS symmetric keys allow for data encryption up to 4096 bytes in size. The data is sent to KMS, it gets encrypted, and then it gets sent back to the sender which could be a service, application, or yourself. In this case, the encryption key never leaves KMS. If you need to encrypt larger data, see →

Encrypt plaintext data using a KMS key:

aws kms encrypt --key-id alias/lab-key --profile cybrkmslab \
  --plaintext fileb://plaintext_favorite_dog.txt \
  --output text --query CiphertextBlob | \
  base64 --decode > encrypted_favorite_dog.txt

Decrypt ciphertext that was encrypted by a KMS key:

aws kms decrypt --key-id alias/lab-key --profile cybrkmslab \
  --ciphertext-blob fileb://encrypted_favorite_dog.txt \
  --output text --query Plaintext | \
  base64 --decode > decrypted_favorite_dog.txt

Encrypting data greater than 4096 bytes in size

When data larger than 4096 bytes needs to be encrypted, KMS can generate a data key. This data key leaves KMS and is sent back to the sender. The sender is then responsible for managing the security of the key.

The data key that you receive is encrypted with a KMS key and you use the decrypted (plaintext) data key to encrypt data. You can then immediately discard it after use since you can retrieve it at a later time for decryption purposes.

Envelope encryption with a data key

Generate data key:

aws kms generate-data-key \
  --key-id alias/lab-key \
  --key-spec AES_256 --profile kmslab

Outputs:
• CiphertextBlob → encrypted_text
• Plaintext → plaintext_key

Encrypt file:

KEY_HEX=$(xxd -p -c 256 plaintext_key)
IV=$(openssl rand -hex 16) && echo $IV > iv.txt

Encrypt file:

openssl enc -aes-256-cbc \
  -K $KEY_HEX -iv $IV \
  -in file.txt -out encrypted_file.txt

rm plaintext_key

- or -

Using the AWS Encryption SDK

Encrypt using the AWS Encryption SDK CLI:

aws-encryption-cli --encrypt \
  --input plaintext_sdk_example.txt \
  --output encrypted_sdk_example.txt \
  --wrapping-keys key=key-arn-value-here profile=cybrkmslab \
  --commitment-policy require-encrypt-require-decrypt \
  --metadata-output metadata

Decrypt using the AWS Encryption SDK CLI:

aws-encryption-cli --decrypt \
  --input encrypted_sdk_example.txt \
  --output decrypted_sdk_example.txt \
  --wrapping-keys key=key-arn-value-here profile=kmslab \
  --metadata-output metadata --max-encrypted-data-keys 1 \
  --buffer --commitment-policy require-encrypt-require-decrypt

🧪 Learn KMS By Doing

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Encrypt and Decrypt Data with KMS and Data Keys
Source: https://cybr.com/cheat-sheets/kms-encryption-data-keys/

My goal: Help me implement encryption

Help me implement encryption and decryption with KMS. Ask about my data size, runtime, AWS profile, key, and intended use. Choose direct KMS encryption or envelope encryption, provide a complete worked example, and verify the decrypted output. Explain binary/base64 handling and the plaintext versus encrypted data key. Identify gaps in the illustrative OpenSSL example, including authentication and key handling, and use a maintained encryption SDK where appropriate.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "subtitle": "Learn how to encrypt and decrypt data with KMS keys and with Data Keys",
  "plaintext": "You can take plaintext (regular data like what you’re reading right now) and pass it through an encryption algorithm with a KMS Key in order to get ciphertext (encrypted data) back, all without leaving the Key Management Service (KMS) when dealing with smaller data.",
  "symmetric": "By default, when you create a new AWS KMS key, you receive a symmetric encryption KMS key. Symmetric encryption uses the same key to both encrypt and decrypt data.",
  "limit": "KMS symmetric keys allow for data encryption up to 4096 bytes in size. The data is sent to KMS, it gets encrypted, and then it gets sent back to the sender which could be a service, application, or yourself. In this case, the encryption key never leaves KMS. If you need to encrypt larger data, see →",
  "larger": "When data larger than 4096 bytes needs to be encrypted, KMS can generate a data key. This data key leaves KMS and is sent back to the sender. The sender is then responsible for managing the security of the key.",
  "dataKey": "The data key that you receive is encrypted with a KMS key and you use the decrypted (plaintext) data key to encrypt data. You can then immediately discard it after use since you can retrieve it at a later time for decryption purposes.",
  "encrypt": "aws kms encrypt --key-id alias/lab-key --profile cybrkmslab \\\n  --plaintext fileb://plaintext_favorite_dog.txt \\\n  --output text --query CiphertextBlob | \\\n  base64 --decode > encrypted_favorite_dog.txt",
  "decrypt": "aws kms decrypt --key-id alias/lab-key --profile cybrkmslab \\\n  --ciphertext-blob fileb://encrypted_favorite_dog.txt \\\n  --output text --query Plaintext | \\\n  base64 --decode > decrypted_favorite_dog.txt",
  "generate": "aws kms generate-data-key \\\n  --key-id alias/lab-key \\\n  --key-spec AES_256 --profile kmslab",
  "outputs": "Outputs:\n• CiphertextBlob → encrypted_text\n• Plaintext → plaintext_key",
  "prepare": "KEY_HEX=$(xxd -p -c 256 plaintext_key)\nIV=$(openssl rand -hex 16) && echo $IV > iv.txt",
  "openssl": "openssl enc -aes-256-cbc \\\n  -K $KEY_HEX -iv $IV \\\n  -in file.txt -out encrypted_file.txt\n\nrm plaintext_key",
  "sdkEncrypt": "aws-encryption-cli --encrypt \\\n  --input plaintext_sdk_example.txt \\\n  --output encrypted_sdk_example.txt \\\n  --wrapping-keys key=key-arn-value-here profile=cybrkmslab \\\n  --commitment-policy require-encrypt-require-decrypt \\\n  --metadata-output metadata",
  "sdkDecrypt": "aws-encryption-cli --decrypt \\\n  --input encrypted_sdk_example.txt \\\n  --output decrypted_sdk_example.txt \\\n  --wrapping-keys key=key-arn-value-here profile=kmslab \\\n  --metadata-output metadata --max-encrypted-data-keys 1 \\\n  --buffer --commitment-policy require-encrypt-require-decrypt"
}