import base64


def _decrypt(client, crypto_key_id, encrypted_secret):
    """ Decrypt a secret using the Google Key Management Service. """

    response = client \
        .projects() \
        .locations() \
        .keyRings() \
        .cryptoKeys() \
        .decrypt(name=crypto_key_id, body={"ciphertext": encrypted_secret}) \
        .execute()

    return base64.b64decode(response["plaintext"]).decode("utf-8").strip()