Using AWS KMS API via PHP SDK

using-aws-kms.php

<?php

use Aws\Kms\KmsClient;

// Somewhere in the controller or model
$this->load->config('aws');

// Not needed for EC2 instance role based authorization - for my local instance only
$key = $this->config->item('aws_s3_access_key');
$secret = $this->config->item('aws_s3_secret_key');

$orig = 'encrypt me please...';
$cryptic = 'CiD/AT9S0xQbpFXHDdw7Mq42htuEVj0vwvZzfR+9GRZCahKbAQEBAgB4/wE/UtMUG6RVxw3cOzKuNobbhFY9L8L2c30fvRkWQmoAAAByMHAGCSqGSIb3DQEHBqBjMGECAQAwXAYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjARBAxvNDVWPh6W4STdWakCARCAL/nzjIDZ8uQWAMWI1VBoNPt+TCe9qZMMbY1d1PnVjlJGa/BcVdAyN9KruzEOcFl6';

// Testing the encrypt and decrypt cycle
$kms = KmsClient::factory([
    'credentials' => [
        'key'    => $key,
        'secret' => $secret,
    ],
    'region' => 'us-east-1',
]);

// Encrypt - should match $cryptic
$result = $kms->encrypt([
    'KeyId' => 'alias/argus-db-crypt-local',
    'Plaintext' => $orig,
]);

var_dump(base64_encode($result->get('CiphertextBlob')));

// Decrypt - should match $orig
$result = $kms->decrypt([
    'CiphertextBlob' => base64_decode($cryptic),
]);

var_dump($result->get('Plaintext'));