#!/usr/bin/env bash

if [ -z ${KMS_KEY_ID} ]; then
  echo "KMS_KEY_ID unset! Exiting";
  exit 1
fi

_INPUT=$1

cat $_INPUT \
| aws kms encrypt \
--key-id=${KMS_KEY_ID} \
--plaintext fileb://<(cat -) \
--output text \
--query CiphertextBlob \
| base64 --decode > output.kms.yml