func DecryptEnvelope(envelope *Envelope) ([]byte, error) {
	keyService, err := getKeyService(envelope.Env, envelope.Region, envelope.MasterKeyID)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to obtain key service for env:%+q, region:%+q, masterKeyID:%+q", envelope.Env, envelope.Region, envelope.MasterKeyID)
	}
	encryptionKey := &envelope.Key
	if err := keyService.DecryptKey(encryptionKey); err != nil {
		return nil, errors.Wrapf(err, "failed to decrypt key")
	}
	data, err := base64.RawURLEncoding.DecodeString(envelope.Data)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to decode data")
	}
	result, err := encryptionKey.Decrypt(data)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to decrypt data")
	}
	return result, nil
}
DecryptEnvelope will access the key service and decrypt the envelope.
package secrets
import (
	"encoding/base64"
	"fmt"
	"time"
	"github.com/pkg/errors"
)
const (
	envDev = "dev"
	envAWS = "aws"
)
func EncryptEnvelope(env, region, masterKeyID string, message []byte) (*Envelope, error) {
	keyService, err := getKeyService(env, region, masterKeyID)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to obtain key service for env:%+q, region:%+q, masterKeyID:%+q", env, region, masterKeyID)
	}
	kid := "sm-" + time.Now().Format(time.RFC3339)
	encryptionKey, err := keyService.GenerateKey(kid)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to generate encryption key")
	}
	ciphertext, err := encryptionKey.Encrypt(message)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to encrypt")
	}
	envelope := &Envelope{
		Env:         env,
		Region:      region,
		MasterKeyID: masterKeyID,
		Key:         *encryptionKey,
		Data:        base64.RawURLEncoding.EncodeToString(ciphertext),
	}
	return envelope, nil
}