Decrypt

Description

Decrypts data encrypted with a KMS key using the Encrypt, GenerateDataKey, and GenerateDataKeyWithoutPlaintext methods.

Request Parameters

Required parameters

• CiphertextBlob — The encrypted data.

  • Type: Base64-encoded binary data

  • Required: Yes

  • Length constraints: From 1 to 6144 bytes

Optional parameters

• EncryptionContext — The encryption context used as additional authenticated data (AAD).

  • Type: Map of strings

  • Required: No

  • Constraints: The total length of all strings in UTF-8 encoding must not exceed 6144 bytes

Response Elements

• Plaintext — The original data.

  • Type: Base64-encoded binary data

  • Length constraints: From 1 to 4096 bytes

Examples

Sample Request

POST / HTTP/1.1
Host: kms.<region>.<domain>
Content-Length: <PayloadSizeBytes>
Content-Type: application/x-amz-json-1.1
Authorization: AWS4-HMAC-SHA256 Credential=<Credential>, SignedHeaders=<Headers>, Signature=<Signature>
X-Amz-Date: <Date>
X-Amz-Target: TrentService.Decrypt

{
    "CiphertextBlob": "AAAAAM4+iMkZakUYoOjQVwv/+Rble77a9sKsVR2b6Ip5dCTccveHBXG2NShREn9ez3WXAEJYOHwKspxa0GfmLieIiz9sUXPXnfUMTUrLWKtrft+x0dZvcvWU0YY8"
}

Sample Response

HTTP/1.1 200 OK
Content-Type: application/x-amz-json-1.1

{
    "Plaintext": "SGVsbG8sIHdvcmxkIQ=="
}