Network.AWS.KMS.Decrypt

Decrypts ciphertext. Ciphertext is plaintext that has been previously encrypted by using any of the following functions:

• GenerateDataKey
• GenerateDataKeyWithoutPlaintext
• Encrypt

Note that if a caller has been granted access permissions to all keys (through, for example, IAM user policies that grant Decrypt permission on all resources), then ciphertext encrypted by using keys in other accounts where the key grants access to the caller can be decrypted. To remedy this, we recommend that you do not grant Decrypt access in an IAM user policy. Instead grant Decrypt access only in key policies. If you must grant Decrypt access in an IAM user policy, you should scope the resource to specific keys or to specific trusted accounts.

See: AWS API Reference for Decrypt.

Creating a Request

decrypt

Arguments

:: ByteString

decCiphertextBlob

-> Decrypt

Creates a value of Decrypt with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• decEncryptionContext
• decGrantTokens
• decCiphertextBlob

data Decrypt

See: decrypt smart constructor.

Instances

Eq Decrypt

Data Decrypt

Read Decrypt

Show Decrypt

Generic Decrypt

ToJSON Decrypt

AWSRequest Decrypt

ToPath Decrypt

ToHeaders Decrypt

ToQuery Decrypt

type Rep Decrypt

type Rs Decrypt = DecryptResponse

Request Lenses

decEncryptionContext :: Lens' Decrypt (HashMap Text Text)

The encryption context. If this was specified in the Encrypt function, it must be specified here or the decryption operation will fail. For more information, see Encryption Context.

decGrantTokens :: Lens' Decrypt [Text]

A list of grant tokens.

For more information, go to Grant Tokens in the AWS Key Management Service Developer Guide.

decCiphertextBlob :: Lens' Decrypt ByteString

Ciphertext to be decrypted. The blob includes metadata.

Note: This Lens automatically encodes and decodes Base64 data, despite what the AWS documentation might say. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

Destructuring the Response

decryptResponse

Arguments

:: Int

drsResponseStatus

-> DecryptResponse

Creates a value of DecryptResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• drsKeyId
• drsPlaintext
• drsResponseStatus

data DecryptResponse

See: decryptResponse smart constructor.

Instances

Eq DecryptResponse

Data DecryptResponse

Read DecryptResponse

Show DecryptResponse

Generic DecryptResponse

type Rep DecryptResponse

Response Lenses

drsKeyId :: Lens' DecryptResponse (Maybe Text)

ARN of the key used to perform the decryption. This value is returned if no errors are encountered during the operation.

drsPlaintext :: Lens' DecryptResponse (Maybe ByteString)

Decrypted plaintext data. This value may not be returned if the customer master key is not available or if you didn't have permission to use it.

Note: This Lens automatically encodes and decodes Base64 data, despite what the AWS documentation might say. The underlying isomorphism will encode to Base64 representation during serialisation, and decode from Base64 representation during deserialisation. This Lens accepts and returns only raw unencoded data.

drsResponseStatus :: Lens' DecryptResponse Int

The response status code.