when you try a restore it will prompt you for the decryption password and will try it immediately. As an alternative, you could use an AWS utility to copy the files locally then set up a new backup storage target to that local storage and re-sync the repository and then restore from there.

When you say it will try the password immediately - since this is a glacier restore, doesn't that mean it would have to wait a few hours for the files to become available before it could try decrypting them? Or is it able to test the decryption before it actually starts downloading files?

In order to test this I decided to try just restoring a single file using the expediated glacier restore option. According to amazon's description for an expediated request, the data should be ready within 1-5 minutes. I've been running my restore now for 30 minutes and the file still hasn't downloaded. It's just a 1meg file. I'm running the restore without trying to decrypt it since I don't think I backed it up with encryption, although I'm not sure. If I did encrypt the files and tried to restore them without the correct password, would it result in the restore taking forever to complete (or just not completing) ?

Ok - of course 5 minutes after I posted this it finished. Not sure why it took 36 minutes, but it finished downloading, and i can read the file so looks like there's no encryption on that backup. Still have one other one that I need to restore but I'll try that one later.