Decrypting KMS encrypted data

codahale / sneaker

A tool for securely storing secrets on S3 using Amazon KMS.

Other

801 stars 34 forks source link

Decrypting KMS encrypted data #28

Open kenwan12 opened 7 years ago

kenwan12 commented 7 years ago

Hi,

If a got a piece of data encrypted with a KMS key, how can I use sneaker to decrypt it ? Shall I just upload the file to the S3 bucket manually and use

sneaker download s3_path decrypted_file

Many thanks

Ken

dskyberg commented 7 years ago

The Sneaker algorithm uses the S3 path as part of the KMS encryption context, to encrypt an AES256 encryption key. KMS is used to protect the AES encryption key. So, if you didn't encrypt the data with Sneaker, then you really can't use Sneaker for decrypting it. Try looking at the AWS SDK for Go for guidance on how to use KMS to decrypt.