class_docstr: Encapsulation for a set of credentials.
  
  When storing to or loading from a Driver, the raw credentials data may or may not be encrypted
  (e.g. when writing to disk, we should always keep it encrypted). To allow Credentials to be
  passed from Driver to Driver without excessive calls to KMS.encrypt/decrypt, this "data" in
  the Credentials can be either encrypted or not. It is up to the code that constructs the
  Credentials object to know which.
  
  When retrieving the raw, unencrypted data from a Credentials object, use the following code:
  
      if credentials.is_encrypted():
          return credentials.get_data_kms_decrypted()
      else:
          return credentials.data()
class_docstr_tok: ["Encapsulation","for","a","set","of","credentials",".","When","storing","to","or","loading","from","a","Driver",",","the","raw","credentials","data","may","or","may","not","be","encrypted","(","e.g",".","when","writing","to","disk",",","we","should","always","keep","it","encrypted",")",".","To","allow","Credentials","to","be","passed","from","Driver","to","Driver","without","excessive","calls","to","KMS.encrypt\/decrypt",",","this","``","data","''","in","the","Credentials","can","be","either","encrypted","or","not",".","It","is","up","to","the","code","that","constructs","the","Credentials","object","to","know","which",".","When","retrieving","the","raw",",","unencrypted","data","from","a","Credentials","object",",","use","the","following","code",":","if","credentials.is_encrypted","(",")",":","return","credentials.get_data_kms_decrypted","(",")","else",":","return","credentials.data","(",")"]
docstr: Returns the data of this Credentials objects, decrypted with KMS.
  
  This does not mutate the internals of this Credentials for safety. It simply returns
  the decrypted payload. It is up to the called to safely manage the payload.
  
  Returns:
      str|None: The decrypted payload of this Credentials object, if it is encrypted. If it is
          not encrypted, then will return None and log an error.
docstr_tok: ["Returns","the","data","of","this","Credentials","objects",",","decrypted","with","KMS",".","This","does","not","mutate","the","internals","of","this","Credentials","for","safety",".","It","simply","returns","the","decrypted","payload",".","It","is","up","to","the","called","to","safely","manage","the","payload",".","Returns",":","str|None",":","The","decrypted","payload","of","this","Credentials","object",",","if","it","is","encrypted",".","If","it","is","not","encrypted",",","then","will","return","None","and","log","an","error","."]
code: def get_data_kms_decrypted(self):
      """Returns the data of this Credentials objects, decrypted with KMS.
  
      This does not mutate the internals of this Credentials for safety. It simply returns
      the decrypted payload. It is up to the called to safely manage the payload.
  
      Returns:
          str|None: The decrypted payload of this Credentials object, if it is encrypted. If it is
              not encrypted, then will return None and log an error.
      """
      if not self._is_encrypted:
          LOGGER.error(
              "Cannot decrypt Credentials as they are already decrypted"
          )
          return None
  
      try:
          return AwsKms.decrypt(self._data, region=self._region)
      except ClientError:
          LOGGER.exception(
              "an error occurred during credentials decryption"
          )
          return None
  
imports: import json
  import os
  import shutil
  import tempfile
  from abc import abstractmethod
  from botocore.exceptions import ClientError
  from streamalert.shared.helpers.aws_api_client import AwsKms, AwsSsm
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 4 for calling the Credentials obj's underlying member method code with example usage: obj.get_data_kms_decrypted() and returns: None, AwsKms, None