kms_decrypt: Decrypts ciphertext

Description

Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following operations:

Usage

kms_decrypt(CiphertextBlob, EncryptionContext, GrantTokens)

Arguments

CiphertextBlob

[required] Ciphertext to be decrypted. The blob includes metadata.

EncryptionContext

The encryption context. If this was specified in the Encrypt function, it must be specified here or the decryption operation will fail. For more information, see Encryption Context.

GrantTokens

A list of grant tokens.

For more information, see Grant Tokens in the AWS Key Management Service Developer Guide.

Request syntax

svc$decrypt(
  CiphertextBlob = raw,
  EncryptionContext = list(
    "string"
  ),
  GrantTokens = list(
    "string"
  )
)

Details

GenerateDataKey
GenerateDataKeyWithoutPlaintext
Encrypt

Whenever possible, use key policies to give users permission to call the Decrypt operation on the CMK, instead of IAM policies. Otherwise, you might create an IAM user policy that gives the user Decrypt permission on all CMKs. This user could decrypt ciphertext that was encrypted by CMKs in other accounts if the key policy for the cross-account CMK permits it. If you must use an IAM policy for Decrypt permissions, limit the user to particular CMKs or particular trusted accounts.

The result of this operation varies with the key state of the CMK. For details, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.

Examples

Run this code

# NOT RUN {
# The following example decrypts data that was encrypted with a customer
# master key (CMK) in AWS KMS.
# }
# NOT RUN {
svc$decrypt(
  CiphertextBlob = "<binary data>"
)
# }
# NOT RUN {
# }