Decrypt

The Decrypt policy decrypts portions of Kafka messages that were previously encrypted using a referenced key.
Use this policy to enforce consistent decryption standards across Kong Event Gateway clients.

This policy uses AES-256-GCM for decryption, which requires keys to be 256 bits in length.

Use this policy together with the Encrypt policy, which encrypts portions of a message using the same referenced key.

Common use cases for the Decrypt policy:

This policy runs during the consume phase.

1. A Kafka client produces a message and sends it to Event Gateway.
2. Event Gateway encrypts the specified values using the provided key.
3. Event Gateway sends the encrypted message to the Kafka broker, which processes it using the key.
4. Event Gateway decrypts the specified values using the provided key, then sends the message to the client.

 
sequenceDiagram
  autonumber
  participant client as Client
  participant egw as Event Gateway
  participant broker as Event broker

  client->>egw: produce message
  egw->>egw: encrypt message
  egw->>broker: send encrypted message
  broker->>egw: consume message
  egw->>egw: decrypt message
  egw->>client: send message

  

The Encrypt policy appends a kong/enc header to each message. This header identifies the encryption key by its ID for example when using a static key the resulting message appears as follows:

{
	"Partition": 0,
	"Offset": 2,
	"Headers": {
		"kong/enc": "\u0000\u0001\u0000-static://019a537d-96ca-74f7-8903-aa99905e722d"
	},
	"Value": "deJ415liQWUEP8j33Yrb/7knuwRzHrHNRDQkkePePZ18MShhlY9A++ZFH/9uaHRb+Q=="
}

When decrypting, the Decrypt policy reads the key reference from the kong/enc header. It then retrieves the corresponding key from the configured key sources and uses it to decrypt the message.

Key sources

You must define a key for the Decrypt policy. This policy supports the following key sources:

• AWS (aws): An AWS key vault.
• Static (static): An array of explicitly defined static keys.

If a topic contains both encrypted and unencrypted records, the Decrypt policy fails on unencrypted records because it can’t find a key reference in the kong/enc header.

To prevent this, add a condition that runs the policy only on records that carry the kong/enc header. The Encrypt policy adds this header to every record that it encrypts:

"condition": "'kong/enc' in record.headers"

For a full configuration, see Example: Decrypt records in a topic with both encrypted and unencrypted records.