S3 command line tool which defaults to client side encryption