@Override
  public byte[] decrypt(final byte[] ciphertext, final byte[] associatedData)
      throws GeneralSecurityException {
    try {
      DecryptRequest req =
          new DecryptRequest().withKeyId(keyArn)
              .withCiphertextBlob(ByteBuffer.wrap(ciphertext));
      if (associatedData != null && associatedData.length != 0) {
        req = req.addEncryptionContextEntry("associatedData", BinaryUtils.toHex(associatedData));
      }
      DecryptResult result = kmsClient.decrypt(req);
      // In AwsKmsAead.decrypt() it is important to check the returned KeyId against the one
      // previously configured. If we don't do this, the possibility exists for the ciphertext to
      // be replaced by one under a key we don't control/expect, but do have decrypt permissions
      // on.
      // The check is disabled if keyARN is not in key ARN format.
      // See https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id.
      if (isKeyArnFormat(keyArn) && !result.getKeyId().equals(keyArn)) {
        throw new GeneralSecurityException("decryption failed: wrong key id");
      }
      return result.getPlaintext().array();
    } catch (AmazonServiceException e) {
      throw new GeneralSecurityException("decryption failed", e);
    }
  }
This client knows how to talk to AWS KMS.
java_src/src/main/java/com/google/crypto/tink/integration/awskms/AwsKmsAead.java