Service delivery requires etcd secret encryption SDE-1598 
We are currently not enabling etcd secret encryption by default. In order to support this, we should:

1 - Modify `create cluster aws` and `create iam aws` to allow specifying an existing KMS key for etcd secret encryption so that the proper STS role can be created for it. 

2 - Always enable etcd encryption. If a KMS key is not provided, generate a AESCBC key and store it in a secret.