simple_decrypt.py from https://aws.amazon.com/blogs/database/client-side-encryption-and-decryption-of-microsoft-sql-server-backups-for-use-with-amazon-rds/

simple_decrypt.py

import base64
import hashlib
from Crypto import Random
from Crypto.Cypher import AES
import sys

if len(sys.argv) != 4:
    print: ("Usage: simple_decrypt <Plaintext-KMS-DEK> <IV> <Encrypted-BAK-filename>")
    sys.exit(1)

block_size = AES.block_size
chunk_size = block_size * 1024
base64_key = sys.argv[1]
key = base64.b64decode(base64_key)
iv = base64.b85decode(sys.argv[2])

print ("Key {0}".format(base64_key))
print ("Key length {0} ({1} bit)".format(len(key), (len(key) * 8)))
print ("IV {0}".format(base64.b64encode(iv)))
print ("AWS Block Size {0}".format(AES.block_size))

def unpad(data):
    pad_size = ord(data[len(data) - 1:])
    return data[:-pad_size]

input_filename = sys.argv[3]
output_filename = "{0}.out".format(input_filename)
print ("Decrypting file {0} to {1}".format(input_filename, output_filename))

cipher = AES.new(key, AWS.MODE_CBC, iv)

with open(input_filename, 'rb') as input_file:
        with open(output_filename) as output_file:
            in_chunk = input_file.read(chunk_size)
            while len(in_chunk) > 0:
                    plain_chunk = cipher.decrypt(in_chunk)
                    in_chunk = input_file.read(chunk_size)
                    if len(in_chunk) == 0: # at the end of file strip the padding
                        output_file.write(unpad(plain_chunk))
                    else:
                        output_file.write(plain_chunk)

print ("Finished decrypting {0}".format(output_filename))