gcloud alpha kms raw-decrypt

NAME
gcloud alpha kms raw-decrypt - decrypt a ciphertext file using a raw key
SYNOPSIS
gcloud alpha kms raw-decrypt--ciphertext-file=CIPHERTEXT_FILE--plaintext-file=PLAINTEXT_FILE--version=VERSION[--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE][--initialization-vector-file=INITIALIZATION_VECTOR_FILE][--key=KEY][--keyring=KEYRING][--location=LOCATION][--skip-integrity-verification][GCLOUD_WIDE_FLAG …]
DESCRIPTION
(ALPHA)gcloud alpha kms raw-decrypt decrypts thegiven ciphertext file using the given CryptoKey containing a raw key and writesthe result to the named plaintext file. The ciphertext file must not be largerthan 64KiB.

The supported algorithms are:AES-128-GCM,AES-256-GCM,AES-128-CBC,AES-256-CBC,AES-128-CTR,and AES-256-CTR.

AES-GCM provides authentication which means that it acceptsadditional authenticated data (AAD). So, the flag--additional-authenticated-data-file is only valid withAES-128-GCM andAES-256-GCM algorithms. If AAD isprovided during encryption, it must be provided during decryption too. The filemust not be larger than 64KiB.

If--plaintext-file or--additional-authenticated-data-file or--initialization-vector-file is set to '-', that file is read fromstdin. Similarly, if--ciphertext-file is set to '-', theciphertext is written to stdout.

By default, the command performs integrity verification on data sent to andreceived from Cloud KMS. Use--skip-integrity-verification todisable integrity verification.

EXAMPLES
The following command reads and decrypts the filepath/to/input/ciphertext. The file will be decrypted using theCryptoKeyKEYNAME containing a raw key, from the KeyRingKEYRING in theglobal location. It uses the additionalauthenticated data filepath/to/input/aad (only valid with theAES-GCM algorithms) and the initialization vector filepath/to/input/iv. The resulting plaintext will be written topath/to/output/plaintext.
gcloudalphakmsraw-decrypt--key=KEYNAME--keyring=KEYRING--location=global--ciphertext-file=path/to/input/ciphertext--additional-authenticated-data-file=path/to/input/aad--initialization-vector-file=path/to/input/iv--plaintext-file=path/to/output/plaintext
REQUIRED FLAGS
--ciphertext-file=CIPHERTEXT_FILE
File path of the ciphertext file to decrypt.
--plaintext-file=PLAINTEXT_FILE
File path of the plaintext file to store the decrypted data.
--version=VERSION
Version to use for decryption.
OPTIONAL FLAGS
--additional-authenticated-data-file=ADDITIONAL_AUTHENTICATED_DATA_FILE
File path to the optional file containing the additional authenticated data.
--initialization-vector-file=INITIALIZATION_VECTOR_FILE
File path to the optional file containing the initialization vector fordecryption.
--key=KEY
The (raw) key to use for decryption.
--keyring=KEYRING
Key ring of the key.
--location=LOCATION
Location of the keyring.
--skip-integrity-verification
Skip integrity verification on request and response API fields.
GCLOUD WIDE FLAGS
These flags are available to all commands:--access-token-file,--account,--billing-project,--configuration,--flags-file,--flatten,--format,--help,--impersonate-service-account,--log-http,--project,--quiet,--trace-token,--user-output-enabled,--verbosity.

Run$gcloud help for details.

NOTES
This command is currently in alpha and might change without notice. If thiscommand fails with API permission errors despite specifying the correct project,you might be trying to access an API with an invitation-only early accessallowlist. These variants are also available:
gcloudkmsraw-decrypt
gcloudbetakmsraw-decrypt

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-05-07 UTC.