aws-encryption-sdk-cli

What it is and what it does

aws-encryption-sdk-cli is a command-line wrapper around the AWS Encryption SDK that lets you encrypt and decrypt files and directories from the shell. It handles single files, stdin/stdout, pattern-matched files, and entire directory trees, with optional recursive processing. You specify an AWS KMS key (or keys) as the master key provider, and the tool manages the encryption envelope and metadata.

The tool is designed for operational workflows where you need to protect files at rest using AWS KMS without writing custom code. It supports encryption context (key-value metadata that travels with the ciphertext), metadata output in JSON format, and flexible input/output modes similar to Unix utilities like cp. On decrypt, you can require that specific encryption context keys or pairs be present in the message, and the tool will skip files that don't match those requirements.

Use it for:

• Encrypt sensitive files before uploading to S3 or other storage, using AWS KMS for key management.
• Batch-encrypt entire directory trees in CI/CD pipelines with consistent encryption context for audit trails.
• Decrypt archived encrypted files in shell scripts, verifying encryption context requirements before processing.
• Protect configuration files or secrets on disk using AWS KMS without embedding encryption logic in application code.
• Generate encrypted backups with metadata logging for compliance and forensic purposes.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Command-line tool to encrypt and decrypt files and directories using AWS Encryption SDK, with support for AWS KMS key management and encryption context.

Yes, if you need a straightforward CLI for AWS KMS-based file encryption in operational workflows. The tool is stable, has no known vulnerabilities, and low install friction. The aging maintenance status (260 days since last release) is a minor concern for long-term support, but the package is marked Production/Stable and the underlying aws-encryption-sdk is actively maintained. Install it if your use case fits; avoid it if you need active feature development or prefer a more frequently updated tool.

Install

aws-encryption-sdk-cli on PyPI

pip install aws-encryption-sdk-cli

uv add aws-encryption-sdk-cli

poetry add aws-encryption-sdk-cli

Installing aws-encryption-sdk-cli

Before you install

Low install friction with a pure Python wheel distribution. Maintenance status is aging—last release was 260 days ago—but the package is marked Production/Stable and carries no known vulnerabilities.

License in practice

Licensed under Apache License 2.0 (permissive), so you can use, modify, and distribute it freely as long as you include the license notice and state changes.

Quickstart

pip install aws-encryption-sdk-cli

aws-encryption-cli encrypt --master-keys provider=aws-kms key=arn:aws:kms:region:account:key/id --input plaintext.txt --output plaintext.txt.encrypted

Requires Python 3.10+; aws-encryption-sdk >= 3.1.0 must be installed; cryptography library may require system-level build dependencies (see cryptography installation guide for your OS).

Verify before relying

• Whether the package actively maintains compatibility with Python 3.12 or if it is tested against it despite the classifier.
• Current state of the GitHub repository and whether it is actively maintained by AWS or community-driven.
• Performance characteristics for large files or directories and any memory constraints.

Package facts

Evidence: aws_encryption_sdk_cli-4.3.0-py2.py3-none-any.whl

Keywords: aws-encryption-sdk, aws, kms, encryption, cli, command, line

Tags

More Security packages