My situation is that emr cluster cannot access kms, because we have restricted emr sg outbound rules. Open 443 port for kms in emr sg, it works.