I had this cryptic (pun intended) due to lack of kms:Decrypt permissions when trying to upload larger file (MultiPartUpload).

See following documentation for IAM permissions for MultiPart uploads:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions