a bit old, but I just faced the same issue, specifying a custom EncryptionMaterialsProvider (as described in the previous post) did the trick for me but I did had to also specify my kms endpoint, just because my region:

"fs.s3.cse.kms.endpoint" -> "kms.<region>.amazonaws.com"