Customer KMS ARN for encryption at rest. If not provided, system will use an AWS Entity Resolution managed KMS key.