Customer KMS ARN for encryption at rest. If not provided, system will use an Entity Resolution managed KMS key.