encrypter-aws-kms

AWS KMS encryption provider for the aux4/encrypter facade.

Installing this package registers an aws-kms provider under the encrypter facade. Once installed, encryption is dispatched to AWS KMS whenever the aws-kms provider is selected — the facade command interface (aux4 encrypter encrypt / aux4 encrypter decrypt) stays the same.

Installation

aux4 aux4 pkger install aux4/encrypter-aws-kms

The facade aux4/encrypter is pulled in automatically as a dependency. The AWS CLI (aws) must be available on PATH.

Selecting the provider

The facade chooses a provider via --provider, then the AUX4_ENCRYPTER_PROVIDER environment variable, then config, then the default (aux4).

# Explicit flag
aux4 encrypter encrypt --provider aws-kms --secret alias/my-key 'hello'

# Environment variable
export AUX4_ENCRYPTER_PROVIDER=aws-kms
aux4 encrypter encrypt --secret alias/my-key 'hello'

# Direct provider path (pins the provider, useful for debugging)
aux4 encrypter provider aws-kms encrypt --secret alias/my-key 'hello'

Credentials

AWS credentials are ambient — the provider runs the aws CLI, which resolves credentials the usual way (environment variables such as AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_PROFILE / AWS_REGION, shared config files, or an instance/role profile). This package does not manage credentials.

The --secret value

For this provider, --secret is the KMS key identifier used on encryption — a key alias (alias/my-key) or a key ARN. It is passed straight to aws kms encrypt --key-id.

On decrypt, KMS does not need the key: the ciphertext blob self-describes its key. --secret is therefore optional on decrypt and is accepted and ignored.

The value may be a literal, come from the AUX4_SECRET environment variable, or be a secret://... reference that aux4 core resolves before the provider sees it.

Commands

encrypt

Encrypts plaintext with AWS KMS and prints the base64 CiphertextBlob to stdout (plain base64, no prefix, no --iv).

aux4 encrypter provider aws-kms encrypt --secret alias/my-key 'hello'
echo -n 'hello' | aux4 encrypter provider aws-kms encrypt --secret alias/my-key

Runs:

aws kms encrypt --key-id <secret> --plaintext <base64 plaintext> --output text --query CiphertextBlob

decrypt

Decrypts a base64 ciphertext blob with AWS KMS and prints the plaintext to stdout. No key is required.

aux4 encrypter provider aws-kms decrypt '<base64 blob>'
echo '<base64 blob>' | aux4 encrypter provider aws-kms decrypt

Runs:

aws kms decrypt --ciphertext-blob <blob> --output text --query Plaintext | base64 --decode

Notes

• This provider does not implement generate-secret — KMS keys are managed in AWS, not generated locally.
• No --iv anywhere; the KMS ciphertext blob is self-contained.