The ARN of an encryption key for a destination in Amazon S3. Must belong to the same Region as the destination S3 bucket.