Are there some shard-level setting to make every cluster in that shard use KMS encryption when writing to S3

[aladda]

You could potentially do this through a Global Init Script - https://docs.databricks.com/clusters/init-scripts.html