@Override
  public void encryptSensitiveData(AgentConfigsUpdateEvent event) {
    for (Map.Entry<String, ClusterConfigs> each : event.getClustersConfigs().entrySet()) {
      Cluster cluster = getCluster(Long.parseLong(each.getKey()));
      ClusterConfigs clusterConfigs = each.getValue();
      for (Map.Entry<String, SortedMap<String, String>> clusterConfig : clusterConfigs.getConfigurations().entrySet()) {
        encrypt(
          clusterConfig.getValue(),
          cluster,
          clusterConfig.getKey(),
          encryptionKey.toString());
      }
    }
  }
This encryptor encrypts the sensitive data in config updates sent to ambari-agent.
Decryption happens on the agent side.
ambari-server/src/main/java/org/apache/ambari/server/security/encryption/AgentConfigUpdateEncryptor.java