def kms_decrypt(kms_client, secret):
  """
  Decrypt kms-encrypted string
  Args:
    kms_client (boto3 kms client object): Instantiated kms client object. Usually created through create_aws_clients.
    secret (string): base64 encoded value to be decrypted
  Returns:
    a populated EFPWContext object
  Raises:
    SystemExit(1): If there is an error with the boto3 decryption call (ex. malformed secret)
  """
  try:
    decrypted_secret = kms_client.decrypt(CiphertextBlob=base64.b64decode(secret))['Plaintext']
  except TypeError:
    fail("Malformed base64 string data")
  except ClientError as error:
    if error.response["Error"]["Code"] == "InvalidCiphertextException":
      fail("The decrypt request was rejected because the specified ciphertext \
      has been corrupted or is otherwise invalid.", error)
    elif error.response["Error"]["Code"] == "NotFoundException":
      fail("The decrypt request was rejected because the specified entity or resource could not be found.", error)
    else:
      fail("boto3 exception occurred while performing kms decrypt operation.", error)
  return decrypted_secret