kms_ops.sh

#!/bin/bash
# `./kms_ops.sh encode` for encoding secrets for storage in SSM/Secrets Manager. You need to specify the key
# `./kms_ops.sh decode` for decoding stored and encrypted secrets. You don't need to specify the key
# Feel free to flesh this out as you please.
op=$1
secret=$2
kmskey=$3

enc(){
  local key=$kmskey
  aws kms encrypt \
    --key-id $key \
    --plaintext $secret \
    --query CiphertextBlob \
    --output text;
}

dec(){
  aws kms decrypt \
    --ciphertext-blob \
    fileb://<(echo $secret | base64 -d) \
    --output text \
    --query Plaintext | base64 -d | xargs;
}

usage() {
   echo
   echo "aws kms encrypt/decrypt wrapper to quicken things up."
   echo
   echo "Usage: $0 encode|decode secret [key]"
   echo "Requires aws cli access"
   echo "Examples:"
   echo "    $(basename $0) encode <plaintext secret> key"
   echo "      Encodes a secret into a Cipher storable as a secret"
   echo "    $(basename $0) decode <ciphertext blob>"
   echo "      Pretty obvious, huh?"
   echo
}


case $op in
  "encode")
    enc
    ;;
  "decode")
    dec
    ;;
  *)
    usage
    ;;
esac