private static String getBucketName(String gcsBlobPath) {
    if (!gcsBlobPath.startsWith(GCS_PATH_PREFIX)) {
      throw new IllegalArgumentException(
          "GCS blob paths must start with gs://, got " + gcsBlobPath);
    }

    String bucketAndObjectName = gcsBlobPath.substring(GCS_PATH_PREFIX.length());
    int firstSlash = bucketAndObjectName.indexOf("/");
    if (firstSlash == -1) {
      throw new IllegalArgumentException(
          "GCS blob paths must have format gs://my-bucket-name/my-object-name, got " + gcsBlobPath);
    }
    return bucketAndObjectName.substring(0, firstSlash);
  }
A command-line utility for encrypting small files with envelope encryption and uploading the
results to GCS.

<p>The CLI takes the following required arguments:

<ul>
  <li>mode: "encrypt" or "decrypt" to indicate if you want to encrypt or decrypt.
  <li>kek-uri: The URI for the Cloud KMS key to be used for envelope encryption.
  <li>gcp-credential-file: Name of the file with the GCP credentials (in JSON format) that can
      access the Cloud KMS key and the GCS input/output blobs.
  <li>gcp-project-id: The ID of the GCP project hosting the GCS blobs that you want to encrypt or
      decrypt.
</ul>

<p>When mode is "encrypt", it takes the following additional arguments:

<ul>
  <li>local-input-file: Read the plaintext from this local file.
  <li>gcs-output-blob: Write the encryption result to this blob in GCS. The encryption result is
      bound to the location of this blob. That is, if you rename or move it to a different
      bucket, decryption will fail.
</ul>

<p>When mode is "decrypt", it takes the following additional arguments:

<ul>
  <li>gcs-input-blob: Read the ciphertext from this blob in GCS.
  <li>local-output-file: Write the decryption result to this local file.
java_src/examples/gcs/GcsEnvelopeAeadExample.java