title: aws cli: aws kms encrypt/decrypt using powershell
body: <p>I'm trying to encrypt and decrypt content with the aws cli on powershell (not the powershell specific one but <a href="http://docs.aws.amazon.com/fr_fr/cli/latest/userguide/installing.html" rel="nofollow noreferrer">the standard one</a>)</p>
  
  <h2>Here is my way to do it and that seems closer to the truth:</h2>
  
  <pre class="lang-cs prettyprint-override"><code>$input = "foo"
  $file_path = "$(pwd)\file"
  $region = "eu-west-1"
  
  # ENCRYPT
  $ciphertextblob =
     aws kms encrypt `
       --region $region `
       --key-id "a266be0d-304b-4gf2-8b75-021ba4b0d23a" `
       --plaintext $input |
     ConvertFrom-Json |
     Foreach-Object { $_.CiphertextBlob }
  
  $encrypted = [System.Convert]::FromBase64String($ciphertextblob)
  [io.file]::WriteAllBytes($file_path, $encrypted)
  
  # DECRYPT
  $decrypt =
     aws kms decrypt `
       --region $region `
       --ciphertext-blob "fileb://$file_path"
  
  # SHOW
  $decrypt
  </code></pre>
  
  <p>and the result is</p>
  
  <pre class="lang-json prettyprint-override"><code>{
      "Plaintext": "Zm9v",
      "KeyId": "arn:aws:kms:eu-west-1:639530368848:key/a266be0d-304b-4gf2-8b75-021ba4b0d23a"
  }
  </code></pre>
  
  <h2>As you can see:</h2>
  
  <ul>
  <li>I define an input "foo" that becomes "Zm9v" at the end</li>
  <li>"Zm9v" is not base64</li>
  <li>I take the encrypt command result, transform from JSON to Powershell object then take the CiphertextBlob</li>
  <li>I decode that from base64 to plaintext and write it in a binary file with WriteAllBytes</li>
  <li>finally I use the fileb to read the binary file with the decrypt command</li>
  </ul>
  
  <h2>So my problem seems:</h2>
  
  <p>that I must have a missing encoding somewhere ... if someone could help me progress :-D</p>
  
  <p>Regards,
  Thibault</p>