How can I allow users to access my S3 bucket that's encrypted with a custom AWS KMS key?