* @return the CEK (in plaintext).
*/
private static SecretKey cekByKMS(byte[] cekSecured, String keyWrapAlgo,
EncryptionMaterials materials,
ContentCryptoScheme contentCryptoScheme, AWSKMSClient kms) {
DecryptRequest kmsreq = new DecryptRequest()
.withEncryptionContext(materials.getMaterialsDescription())
.withCiphertextBlob(ByteBuffer.wrap(cekSecured));
DecryptResult result = kms.decrypt(kmsreq);
return new SecretKeySpec(copyAllBytesFrom(result.getPlaintext()),
contentCryptoScheme.getKeyGeneratorAlgorithm());