DECRYPT - Amazon Glue DataBrew
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

DECRYPT

You can use the DECRYPT transform to decrypt inside of DataBrew. Your data can also be decrypted outside of DataBrew with the Amazon Encryption SDK. If the provided KMS key ARN does not match what was used to encrypt the column, the decrypt operation fails. For more information on the Amazon Encryption SDK, see What is the Amazon Encryption SDK in the Amazon Encryption SDK Developer Guide.

Parameters

  • sourceColumns – An array of existing columns.

  • kmsKeyArn – The key ARN of the Amazon Key Management Service key to use to decrypt the source columns. For more information on the key ARN, see Key ARN in the Amazon Key Management Service Developer Guide. 

{
   "sourceColumns": ["phonenumber"],
   "kmsKeyArn": "arn:aws:kms:us-east-1:012345678901:key/<kms-key-id>"
}

When working in the interactive experience, in addition to the project’s role, the console user must have permission to kms:GenerateDataKey and kms:Decrypt on the provided KMS key.

Sample policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "kms:GenerateDataKey",
            "kms:Decrypt"
        ],
        "Resource": [
            "arn:aws:kms:us-east-1:012345678901:key/<kms-key-id>"
        ]
    }
  ]
}