Decrypt KMS-encrypted SES emails in an S3 bucket

decrypt-ses-emails-in-s3.py

import base64
import json

import boto3
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

s3 = boto3.resource('s3')
bucket = s3.Bucket('my-bucket')
kms_client = boto3.client('kms')

for obj in bucket.objects.filter(Prefix='incoming/'):
    print(obj)
    obj_get = obj.get()
    obj_bytes = obj_get['Body'].read()
    data_key = kms_client.decrypt(
        CiphertextBlob=base64.b64decode(obj_get['Metadata']['x-amz-key-v2']),
        EncryptionContext=json.loads(obj_get['Metadata']['x-amz-matdesc']),
    )['Plaintext']
    plain = AESGCM(data_key).decrypt(
        base64.b64decode(obj_get['Metadata']['x-amz-iv']),
        obj_bytes,
        None,
    )
    print(plain)

print('Done')