The KMS key ARN that is used for encryption. If an AWS-managed key is used for encryption, returns empty.