ARN of the customer managed key for encrypting the data at rest. If no KMS key is provided, a default service key is used.