// Decrypts ciphertext that was encrypted by a AWS KMS customer master key (CMK)
// using any of the following operations:
//
// * Encrypt
//
// * GenerateDataKey
//
// *
// GenerateDataKeyPair
//
// * GenerateDataKeyWithoutPlaintext
//
// *
// GenerateDataKeyPairWithoutPlaintext
//
// You can use this operation to decrypt
// ciphertext that was encrypted under a symmetric or asymmetric CMK. When the CMK
// is asymmetric, you must specify the CMK and the encryption algorithm that was
// used to encrypt the ciphertext. For information about symmetric and asymmetric
// CMKs, see Using Symmetric and Asymmetric CMKs
// (https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html)
// in the AWS Key Management Service Developer Guide. The Decrypt operation also
// decrypts ciphertext that was encrypted outside of AWS KMS by the public key in
// an AWS KMS asymmetric CMK. However, it cannot decrypt ciphertext produced by
// other libraries, such as the AWS Encryption SDK
// (https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/) or Amazon
// S3 client-side encryption
// (https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html).
// These libraries return a ciphertext format that is incompatible with AWS KMS. If
// the ciphertext was encrypted under a symmetric CMK, you do not need to specify
// the CMK or the encryption algorithm. AWS KMS can get this information from
// metadata that it adds to the symmetric ciphertext blob. However, if you prefer,
// you can specify the KeyId to ensure that a particular CMK is used to decrypt the
// ciphertext. If you specify a different CMK than the one used to encrypt the
// ciphertext, the Decrypt operation fails. Whenever possible, use key policies to
// give users permission to call the Decrypt operation on a particular CMK, instead
// of using IAM policies. Otherwise, you might create an IAM user policy that gives
// the user Decrypt permission on all CMKs. This user could decrypt ciphertext that
// was encrypted by CMKs in other accounts if the key policy for the cross-account
// CMK permits it. If you must use an IAM policy for Decrypt permissions, limit the
// user to particular CMKs or particular trusted accounts. The CMK that you use for
// this operation must be in a compatible key state. For details, see How Key State
// Affects Use of a Customer Master Key
// (https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html) in the
// AWS Key Management Service Developer Guide.
Decrypts ciphertext that was encrypted by a AWS KMS customer master key (CMK)
using any of the following operations.

Encrypt

GenerateDataKey

GenerateDataKeyPair

GenerateDataKeyWithoutPlaintext

GenerateDataKeyPairWithoutPlaintext

You can use this operation to decrypt
ciphertext that was encrypted under a symmetric or asymmetric CMK. When the CMK
is asymmetric, you must specify the CMK and the encryption algorithm that was
used to encrypt the ciphertext. For information about symmetric and asymmetric
CMKs, see Using Symmetric and Asymmetric CMKs

in the AWS Key Management Service Developer Guide. The Decrypt operation also
decrypts ciphertext that was encrypted outside of AWS KMS by the public key in
an AWS KMS asymmetric CMK. However, it cannot decrypt ciphertext produced by
other libraries, such as the AWS Encryption SDK
or Amazon
S3 client-side encryption
.
These libraries return a ciphertext format that is incompatible with AWS KMS. If
the ciphertext was encrypted under a symmetric CMK, you do not need to specify
the CMK or the encryption algorithm. AWS KMS can get this information from
metadata that it adds to the symmetric ciphertext blob. However, if you prefer,
you can specify the KeyId to ensure that a particular CMK is used to decrypt the
ciphertext. If you specify a different CMK than the one used to encrypt the
ciphertext, the Decrypt operation fails. Whenever possible, use key policies to
give users permission to call the Decrypt operation on a particular CMK, instead
of using IAM policies. Otherwise, you might create an IAM user policy that gives
the user Decrypt permission on all CMKs. This user could decrypt ciphertext that
was encrypted by CMKs in other accounts if the key policy for the cross-account
CMK permits it. If you must use an IAM policy for Decrypt permissions, limit the
user to particular CMKs or particular trusted accounts. The CMK that you use for
this operation must be in a compatible key state. For details, see How Key State
Affects Use of a Customer Master Key
in the
AWS Key Management Service Developer Guide.
// Decrypts ciphertext that was encrypted by a AWS KMS customer master key ( CMK ) // using any of the following operations : // // * Encrypt // // * GenerateDataKey // // * // GenerateDataKeyPair // // * GenerateDataKeyWithoutPlaintext // // * // GenerateDataKeyPairWithoutPlaintext // // You can use this operation to decrypt // ciphertext that was encrypted under a symmetric or asymmetric CMK . When the CMK // is asymmetric you must specify the CMK and the encryption algorithm that was // used to encrypt the ciphertext . For information about symmetric and asymmetric // CMKs see Using Symmetric and Asymmetric CMKs // ( https : // docs . aws . amazon . com / kms / latest / developerguide / symmetric - asymmetric . html ) // in the AWS Key Management Service Developer Guide . The Decrypt operation also // decrypts ciphertext that was encrypted outside of AWS KMS by the public key in // an AWS KMS asymmetric CMK . However it cannot decrypt ciphertext produced by // other libraries such as the AWS Encryption SDK // ( https : // docs . aws . amazon . com / encryption - sdk / latest / developer - guide / ) or Amazon // S3 client - side encryption // ( https : // docs . aws . amazon . com / AmazonS3 / latest / dev / UsingClientSideEncryption . html ) . // These libraries return a ciphertext format that is incompatible with AWS KMS . If // the ciphertext was encrypted under a symmetric CMK you do not need to specify // the CMK or the encryption algorithm . AWS KMS can get this information from // metadata that it adds to the symmetric ciphertext blob . However if you prefer // you can specify the KeyId to ensure that a particular CMK is used to decrypt the // ciphertext . If you specify a different CMK than the one used to encrypt the // ciphertext the Decrypt operation fails . Whenever possible use key policies to // give users permission to call the Decrypt operation on a particular CMK instead // of using IAM policies . Otherwise you might create an IAM user policy that gives // the user Decrypt permission on all CMKs . This user could decrypt ciphertext that // was encrypted by CMKs in other accounts if the key policy for the cross - account // CMK permits it . If you must use an IAM policy for Decrypt permissions limit the // user to particular CMKs or particular trusted accounts . The CMK that you use for // this operation must be in a compatible key state . For details see How Key State // Affects Use of a Customer Master Key // ( https : // docs . aws . amazon . com / kms / latest / developerguide / key - state . html ) in the // AWS Key Management Service Developer Guide .
func (c *Client) Decrypt(ctx context.Context, params *DecryptInput, optFns ...func(*Options)) (*DecryptOutput, error) {
	if params == nil {
		params = &DecryptInput{}
	}
	result, metadata, err := c.invokeOperation(ctx, "Decrypt", params, optFns, addOperationDecryptMiddlewares)
	if err != nil {
		return nil, err
	}
	out := result.(*DecryptOutput)
	out.ResultMetadata = metadata
	return out, nil
}
func ( c * Client ) Decrypt ( ctx context . Context , params * DecryptInput , optFns ... func ( * Options ) ) ( * DecryptOutput , error ) { if params == nil { params = & DecryptInput { } } result , metadata , err := c . invokeOperation ( ctx , " " , params , optFns , addOperationDecryptMiddlewares ) if err != nil { return nil , err } out := result . ( * DecryptOutput ) out . ResultMetadata = metadata return out , nil }
Decrypts ciphertext that was encrypted by a AWS KMS customer master key (CMK)
using any of the following operations.
Decrypts ciphertext that was encrypted by a AWS KMS customer master key ( CMK ) using any of the following operations .