Fixed! The database cluster has Resource ID in the format cluster-xxxxxxx. You need to specify this in the encryption context. Decryption works now