How to use aws kms encrypt when "plaintext" starts with dash (-)

Question

I want to encrypt a client secret that starts with a dash, but if I do something like:

aws kms encrypt --region us-east-1 --key-id xxxyyzz --output text --query CiphertextBlob --plaintext -blahblah-

The result is:

usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:

  aws help
  aws <command> help
  aws <command> <subcommand> help
aws: error: argument --plaintext: expected one argument

Tried escaping like:

aws kms encrypt --region us-east-1 --key-id xxxyyzz --output text --query CiphertextBlob --plaintext \-blahblah-

But got the same error. My searches so far only gave application specific answers (e.g. sed). What's the elusive trick I'm missing?

Answer 1

Well, doing aws kms encrypt help gave me the solution:

$ aws kms encrypt --region us-east-1 --key-id vvvvvvvv --output text --query CiphertextBlob --plaintext fileb://clientsecret.txt

Where clientsecret.txt holds the string that contains dashes, without a new line character.