aws-encryption-sdk-cli
This command line tool can be used to encrypt and decrypt files and directories using the AWS Encryption SDK.
Decision gist · record as of 2026-08-14
Yes, if you need a straightforward CLI for AWS KMS-based file encryption in operational workflows. The tool is stable, has no known vulnerabilities, and low install friction. The aging maintenance status (260 days since last release) is a minor concern for long-term support, but the package is marked Production/Stable and the underlying aws-encryption-sdk is actively maintained. Install it if your use case fits; avoid it if you need active feature development or prefer a more frequently updated tool.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10+; aws-encryption-sdk >= 3.1.0 must be installed; cryptography library may require system-level build dependencies (see cryptography installation guide for your OS).
- Low install friction with a pure Python wheel distribution.
- Maintenance status is aging—last release was 260 days ago—but the package is marked Production/Stable and carries no known vulnerabilities.
License · maintenance · safety
Apache License 2.0 (permissive) — Licensed under Apache License 2.0 (permissive), so you can use, modify, and distribute it freely as long as you include the license notice and state changes.
last release 2025-11-27 (260 days)
0 known vulnerabilities (OSV.dev, 2026-08-14) · 97,274 downloads/mo, #13,158 on PyPI
Alternatives
Verify before relying
pip install aws-encryption-sdk-cli
aws-encryption-cli encrypt --master-keys provider=aws-kms key=arn:aws:kms:region:account:key/id --input plaintext.txt --output plaintext.txt.encrypted- Whether the package actively maintains compatibility with Python 3.12 or if it is tested against it despite the classifier.
- Current state of the GitHub repository and whether it is actively maintained by AWS or community-driven.
- Performance characteristics for large files or directories and any memory constraints.
What it is and what it does
aws-encryption-sdk-cli is a command-line wrapper around the AWS Encryption SDK that lets you encrypt and decrypt files and directories from the shell. It handles single files, stdin/stdout, pattern-matched files, and entire directory trees, with optional recursive processing. You specify an AWS KMS key (or keys) as the master key provider, and the tool manages the encryption envelope and metadata.
The tool is designed for operational workflows where you need to protect files at rest using AWS KMS without writing custom code. It supports encryption context (key-value metadata that travels with the ciphertext), metadata output in JSON format, and flexible input/output modes similar to Unix utilities like cp. On decrypt, you can require that specific encryption context keys or pairs be present in the message, and the tool will skip files that don't match those requirements.
Use it for
- Encrypt sensitive files before uploading to S3 or other storage, using AWS KMS for key management.
- Batch-encrypt entire directory trees in CI/CD pipelines with consistent encryption context for audit trails.
- Decrypt archived encrypted files in shell scripts, verifying encryption context requirements before processing.
- Protect configuration files or secrets on disk using AWS KMS without embedding encryption logic in application code.
- Generate encrypted backups with metadata logging for compliance and forensic purposes.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need a straightforward CLI for AWS KMS-based file encryption in operational workflows.
The tool is stable, has no known vulnerabilities, and low install friction. The aging maintenance status (260 days since last release) is a minor concern for long-term support, but the package is marked Production/Stable and the underlying aws-encryption-sdk is actively maintained. Install it if your use case fits; avoid it if you need active feature development or prefer a more frequently updated tool.
Install
aws-encryption-sdk-cli on PyPI
Before you install
Low install friction with a pure Python wheel distribution. Maintenance status is aging—last release was 260 days ago—but the package is marked Production/Stable and carries no known vulnerabilities.
Requires Python 3.10+; aws-encryption-sdk >= 3.1.0 must be installed; cryptography library may require system-level build dependencies (see cryptography installation guide for your OS).
License in practice
Licensed under Apache License 2.0 (permissive), so you can use, modify, and distribute it freely as long as you include the license notice and state changes.
Quickstart
pip install aws-encryption-sdk-cli
aws-encryption-cli encrypt --master-keys provider=aws-kms key=arn:aws:kms:region:account:key/id --input plaintext.txt --output plaintext.txt.encryptedVerify before relying
- Whether the package actively maintains compatibility with Python 3.12 or if it is tested against it despite the classifier.
- Current state of the GitHub repository and whether it is actively maintained by AWS or community-driven.
- Performance characteristics for large files or directories and any memory constraints.
Package facts
| License | Apache License 2.0 permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 4 packagesbase64ioaws-encryption-sdksetuptoolsattrs |
| Maintenance | Aging 260 days since the last release |
| First released | |
| Downloads | 97,274 / month, #13,158 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseNatural Language :: EnglishProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: Implementation :: CPythonTopic :: SecurityTopic :: Security :: Cryptography |
Evidence: aws_encryption_sdk_cli-4.3.0-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “encrypt decrypt files cli”
- aws-encryption-sdk-cliCommand-line tool to encrypt and decrypt files and directories using…
- sopsySOPSy wraps the SOPS command-line tool to encrypt, decrypt, and…
- gnupgA Python wrapper around GnuPG that lets you generate keys, encrypt,…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also aws-encryption-sdk · sopsy · credstash · crypto · aws-cdk.aws-kms · aws-cryptographic-material-providers · ansible-vault · dynamodb-encryption-sdk · kasa-crypt · davey