title: How To Decrypt AWS Ruby Client-side Encryption in Python
body: <p>AWS's S3 SDK for Ruby allows for client-side ('envelope') encryption of the file.  It's a combination of AES CBC/ECB encryption for the client-side key where the envelope key and initialization vector are stored in the metadata.  </p>
  
  <p>I have a Ruby developer that has encrypted various files in an S3 bucket that I need to retrieve and decrypted with Python.  The Python S3 AWS SDK doesn't currently have this client-side feature.  </p>
  
  <p>Assuming the file was encrypted using the <code>encryption_key</code> parameter of the Ruby <code>bucket.write</code> S3 API:</p>
  
  <pre><code>#!/usr/bin/ruby
  # coding: utf-8
  
  require 'aws-sdk'
  require 'openssl'
  
  access_key = '&lt;aws_access_key&gt;'
  secret_access_key = '&lt;secret_access_key&gt;'
  encryption_key = "passwordpassword"
  
  s3 = AWS::S3.new
  storage_host = "our_bucket"
  storage_path = "prod/master_report/test.txt"
  bucket_obj = s3.buckets[storage_host].objects[storage_path]
  bucket_obj.write(file: 'test.txt', encryption_key: encryption_key)
  </code></pre>
  
  <p>Is there a way to decrypt the files with Python instead of using the Ruby SDK?</p>