kmsKeyArn

The Amazon Resource Name (ARN) of the customer managed KMS key to use for the filter to return objects that are encrypted by the specified key. For best performance, we recommend using the KMSKeyArn filter in conjunction with other object metadata filters, like MatchAnyPrefix, CreatedAfter, or MatchAnyStorageClass.

You must provide the full KMS Key ARN. You can't use an alias name or alias ARN. For more information, see KMS keys in the Amazon Web Services Key Management Service Developer Guide.