serverless-kms-secrets | ️ Serverless plugin to encrypt variables | Serverless library

It looks like the ciphertext_blob argument in Aws::KMS::Client#decrypt expects a binary string that includes the encrypted Ciphertext that you want to decrypt.

In your example, you are passing in an unencrypted Base64 encoded string into decrypt. Instead, you need to to pass in an encrypted binary string.

To get an encrypted string we can call Aws::KMS::Client#encrypt with your keyId (also know as your ARN) and the string you want to encrypt in plaintext.

In the response from that call we get back a ciphertext_blob which is the encrypted binary string that we need to use in order to decode.

Sometimes you might see that binary data "unpacked", which you can demonstrate doing ciphertext_blob.unpack('H*'). If you have unpacked data and want to decrypt it, you will need to pack it: encrypted_upacked_blob.pack('H*').

Here's a full example of a round trip encoding and decoding of a plaintext string: