AWS KMSのつかいかたメモ

enc-dec.rb

#!/usr/bin/env ruby

require 'aws-sdk'
require 'base64'

kms = Aws::KMS::Client.new(region: 'ap-northeast-1')

original = ARGV[0]
p "original = #{original}"

enc = kms.encrypt(key_id: 'alias/keyid', plaintext: original)
b64 = Base64.encode64(enc.ciphertext_blob)
p "encrypted = #{b64}"

dec = kms.decrypt(ciphertext_blob: Base64.decode64(b64))
plt = dec.plaintext
p "decrypted = #{plt}"

適切なIAMロールを付けたインスタンス上で実行

uraura@rosemary$ ./enc-dec.rb 123
"original = 123"
"encrypted = CiAp/x8z6BKqf6hq1uQ6JgnExample5Ozut87kS1Rr+4khKKAQEBAgB4Kf8f\nM+gSqn+oatbkExamplePSzjuTs7rfO5EtUa/uJIAAABhMF8GCSqGSIb3DQEH\nBqBSMFExamplewYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjExampleTR5W1pt\nVBI9OpcCARCAHjh9hTHbUCqgNfhSj7HFYekExampleXI7+OaPUIaxw==\n"
"decrypted = 123"