在 Amazon KMS 中对数据 Blob 重新加密

以下示例使用适用于 Ruby 的 Amazon SDK re_encrypt 方法，该方法可实现 ReEncrypt 操作以解密已加密的数据，然后立即使用新的 Amazon KMS key 对数据重新加密。这些操作全部都在 Amazon KMS 内的服务器端执行，因此它们永远不会将您的明文在 Amazon KMS 外公开。此示例显示了生成的重新加密 Blob 的可读版本。

require "aws-sdk-kms"  # v2: require 'aws-sdk'

# Human-readable version of the ciphertext of the data to reencrypt.

blob = "01020200785d68faeec386af1057904926253051eb2919d3c16078badf65b808b26dd057c101747cadf3593596e093d4ffbf22434a6d00000068306606092a864886f70d010706a0593057020100305206092a864886f70d010701301e060960864801650304012e3011040c9d629e573683972cdb7d94b30201108025b20b060591b02ca0deb0fbdfc2f86c8bfcb265947739851ad56f3adce91eba87c59691a9a1"
sourceCiphertextBlob = [blob].pack("H*")

# Replace the fictitious key ARN with a valid key ID

destinationKeyId = "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321"

client = Aws::KMS::Client.new(region: "us-west-2")

resp = client.re_encrypt({
  ciphertext_blob: sourceCiphertextBlob,
  destination_key_id: destinationKeyId
})

# Display a readable version of the resulting re-encrypted blob.
puts "Blob:"
puts resp.ciphertext_blob.unpack("H*")

请参阅 GitHub 上的完整示例。