Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following operations:
kms_decrypt(CiphertextBlob, EncryptionContext, GrantTokens)
[required] Ciphertext to be decrypted. The blob includes metadata.
The encryption context. If this was specified in the Encrypt function, it must be specified here or the decryption operation will fail. For more information, see Encryption Context.
A list of grant tokens.
For more information, see Grant Tokens in the AWS Key Management Service Developer Guide.
Whenever possible, use key policies to give users permission to call the
Decrypt operation on the CMK, instead of IAM policies. Otherwise, you
might create an IAM user policy that gives the user Decrypt permission
on all CMKs. This user could decrypt ciphertext that was encrypted by
CMKs in other accounts if the key policy for the cross-account CMK
permits it. If you must use an IAM policy for
limit the user to particular CMKs or particular trusted accounts.
The result of this operation varies with the key state of the CMK. For details, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.
1 2 3 4 5 6 7 8 9
1 2 3 4 5
# The following example decrypts data that was encrypted with a customer # master key (CMK) in AWS KMS. svc$decrypt( CiphertextBlob = "<binary data>" )
Add the following code to your website.
For more information on customizing the embed code, read Embedding Snippets.