GCPのKMSを通したencrypt, decryptのサンプル

gcp_kms_enc_dec_sample.sh

#!/bin/bash

#
# base64コマンドはMac, Linuxでオプションが異なるので注意
#

# encrypt
curl -v "https://cloudkms.googleapis.com/v1/projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RINGS_NAME}/cryptoKeys/{CRYPT_KEY_NAME}:encrypt" \
  -d "{\"plaintext\":\"base64-data\"}" \
  -H "Authorization:Bearer $(gcloud auth application-default print-access-token)"\
  -H "Content-Type: application/json" | jq .ciphertext -r > 1.encrypted

# decrypt
curl -v "https://cloudkms.googleapis.com/v1/projects/{PROJECT_ID}/locations/{REGION}/keyRings/{KEY_RINGS_NAME}/cryptoKeys/{CRYPT_KEY_NAME}:decrypt" \
  -d "{\"ciphertext\":\"$(cat 1.encrypted)\"}" \
  -H "Authorization:Bearer $(gcloud auth application-default print-access-token)"\
  -H "Content-Type:application/json" \
| jq .plaintext -r | base64 -d