aws cli kms decrypt file