The URL generated gives this error:

<Error> <Code>InvalidArgument</Code> <Message>Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.</Message> <ArgumentName>Authorization</ArgumentName> <ArgumentValue>null</ArgumentValue> <RequestId>W85KT5SCCQ4CG6C4</RequestId> <HostId>3LGvofRzasRgcRYE64I0ZuCoqJASJqKpSUewXK2hAOss+r3WBpbuy8JIAGEgyZvecCng9CS1bn8=</HostId> </Error>

It's probably related to the way we're instantiating the s3 client. Instantiating it like this worked for me:
AmazonS3 s3Client = AmazonS3ClientBuilder.standard() .withRegion(Regions.US_EAST_1) .withCredentials(awsStaticCredentialsProvider) .build();