Using AWS KMS and migrating AWS accounts

[matthewford]

Hello,

We're migrating AWS accounts and while the keys can't be moved, what's the best way to decrypt the data with the old key and re-ecrypt with the new kms key (give the old and new keys are in different accounts).

[reidmorrison]

The local encrypted file contains the data encryption key that is used to encrypt the data in the database. AWS KMS is only used to encypt and decrypt the data encryption key that is stored locally.

To move AWS accounts, we can decrypt the data encryption key using this method:
https://github.com/reidmorrison/symmetric-encryption/blob/master/lib/symmetric_encryption/keystore/aws.rb#L127

Then under the new AWS account, encrypt the data encryption key from above and write the encrypted version to the encrypted file using:
https://github.com/reidmorrison/symmetric-encryption/blob/master/lib/symmetric_encryption/keystore/aws.rb#L138