KMS Key ARN belonging to the primary destination account and backup region, to encrypt newly created central log groups in the backup destination.