add support for AWS customer provided encryption keys