aws cli kms encrypt file