Decrypt Chef encrypted data bag without Knife

I found myself in the strange situation where I had an encrypted data bag and the secret key but no way to decrypt it without my friendly operations coworkers.

This script solved all my issues, writing the decrypted data to stdout.

require 'chef/encrypted_data_bag_item'
require 'json'

keyfile = "./secret_environment.key"
encrypted_path = "./my-secret-file.json"

secret = Chef::EncryptedDataBagItem.load_secret(keyfile)
encrypted_data = JSON.parse(
plain_data =, secret).to_hash
puts JSON.generate(plain_data)

Make sure to change keyfile and encrypted_path to match your files.

Invoke the script using Chef’s built in Ruby to make sure that the Chef gem is available

/opt/chefdk/embedded/bin/ruby script.rb > decrypted.json

Michael is a polyglot software engineer, committed to reducing complexity in systems and making them more predictable. Working with a variety of languages and tools, he shares his technical expertise to audiences all around the world at user groups and conferences. You can follow @mheap on Twitter

Thoughts on this post

Jonathan 2016-08-08

Thanks! This worked great and helped me get what I needed without having to get a Chef server up and running.

Saurabh Hirani 2017-08-10

Thanks – this was useful info.

Leave a comment?

Leave a Reply