replicakmskeyid must be specified if ssekmsencryptedobjects tag is present