# Decrypt Filter Function

The decrypt filter plugin for Treasure Data's integrations allows you to decrypt columns using an encryption algorithm such as AES.

* [Options](/products/customer-data-platform/integration-hub/batch/import/filter/decrypt-filter-function#options)
* [Configuration](/products/customer-data-platform/integration-hub/batch/import/filter/decrypt-filter-function#configuration)
* [Advanced Configuration (S3)](/products/customer-data-platform/integration-hub/batch/import/filter/decrypt-filter-function#advanced-configuration-s3)


## Options

The decrypt filter plugin contains the following options:

| Option | Description |
|  --- | --- |
| algorithm
 | Encryption algorithm (string, required)
Available algorithms are:
- AES-256-CBC
- AES-192-CBC
- AES-128-CBC
- AES-256-ECB
- AES-192-ECB
- AES-128-ECB

 |
| column_names | Names of string columns to decrypt (array, required) |
| key_type | Encryption type, can be either "inline" or "s3" (string, optional, default: inline) |
| key_hex | Encryption key (string, required if key_type is inline) |
| key_iv | Encryption initialization vector (string, required if the mode of the algorithm is CBC and key_type is inline) |
| input_encoding | The encoding of encrypted value can be either "base64" or "hex" (string, optional, default: base64) |
| aws_params | AWS/S3 parameters (a hash, required if key_type is s3) |


| Child Elements (aws_params) | Description |
|  --- | --- |
| region | a valid AWS region (string, required) |
| access_key | a valid AWS access key (string, required) |
| secret_key | a valid AWS secret key (string, required) |
| bucket | a valid S3 bucket (string, required) |
| path | a valid S3 key, S3 file path (string, required) |


## Configuration

Add the `filter` section, including the type, to your `load.yml`. In the following example, the filter type is decrypt:

```yaml
in:
...
filters:
- type: decrypt
  algorithm: AES-256-CBC
  column_names:
    - password
    - ip
  key_hex: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  key_iv: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
out:
 ...
```

## Advanced Configuration (S3)

Add the `filter` section, including the type, to your `load.yml`. In the following example, the type is decrypted and key_type is s3:

```yaml
in:
...
filters:
- type: decrypt
  algorithm: 'AES-256-CBC'
  column_names:
    - column_one
    - column_two
  aws_params:
    region: us-east-1
    access_key: <accessKey>
    secret_key: <secretKey>
    bucket: <bucket>
    path: key.yml
  key_hex: <key_hex>
  iv_hex: <iv_hex>
out:
```

S3 key file should be in valid YAML format: (iv_hex is required if mode of the algorithm is CBC)

```yaml
key_hex: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
key_iv: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```