# DECRYPT
<a name="recipe-actions.DECRYPT"></a>

You can use the DECRYPT transform to decrypt inside of DataBrew. Your data can also be decrypted outside of DataBrew with the Amazon Encryption SDK. If the provided KMS key ARN does not match what was used to encrypt the column, the decrypt operation fails. For more information on the Amazon Encryption SDK, see [What is the Amazon Encryption SDK](https://docs.amazonaws.cn/encryption-sdk/latest/developer-guide/introduction.html) in the *Amazon Encryption SDK Developer Guide*.

**Parameters**
+ `sourceColumns` – An array of existing columns.
+ `kmsKeyArn` – The key ARN of the Amazon Key Management Service key to use to decrypt the source columns. For more information on the key ARN, see [Key ARN](https://docs.amazonaws.cn/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the *Amazon Key Management Service Developer Guide*. 

```
{
   "sourceColumns": ["phonenumber"],
   "kmsKeyArn": "arn:aws:kms:us-east-1:012345678901:key/<kms-key-id>"
}
```

When working in the interactive experience, in addition to the project’s role, the console user must have permission to `kms:GenerateDataKey` and `kms:Decrypt` on the provided KMS key.

**Sample policy:**

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "kms:GenerateDataKey",
            "kms:Decrypt"
        ],
        "Resource": [
            "arn:aws-cn:kms:us-east-1:012345678901:key/kms-key-id"
        ]
    }
  ]
}
```

------