Error messages when using KMS-encrypted S3 buckets can be uninformative

Confirm by changing [ ] to [x] below to ensure that it's a bug:
- [x] I've gone though the [User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) and the [API reference](https://docs.aws.amazon.com/cli/latest/reference/)
- [x] I've searched for [previous similar issues](https://github.com/aws/aws-cli/issues) and didn't find any solution

**Describe the bug**
Using `aws s3 cp` commands on a customer-managed-KMS-key-encrypted S3 bucket, as a user without the appropriate `kms:Decrypt` and `kms:GenerateDataKey` permissions, no longer gives an informative error message. Instead, the following error is emitted: `An error occurred (AccessDenied) when calling the 'PutObject' operation: Access Denied`.

Could this be changed to emit something more informative for users?

The commands used to replicate the issue are: `aws s3 cp ` and `aws s3 cp `

**SDK version number**
`aws --version` output: `aws-cli/2.4.11`

**Platform/OS/Hardware/Device**
What are you running the cli on?
`aws --version` output:
```
Python/3.8.8
Linux/5.13.0-28-generic
exe/x86_64.ubuntu.21 prompt/off
```

**To Reproduce (observed behavior)**
This terraform should be sufficient:
```
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "3.71.0"
}
}
}

# Note that this key has no policy granting 'kms:Decrypt'
# and 'kms:GenerateDataKey' attached to it, => if this is
# used to encrypt an S3 bucket, 's3:PutObject' and
# 's3:GetObject' to that bucket will fail.
resource "aws_kms_key" "some_encryption_key" {
description = "Encrypts 'some_encrypted_bucket'"
deletion_window_in_days = 30
enable_key_rotation = "true"
}

resource "aws_s3_bucket" "some_encrypted_bucket" {

bucket = "i-think-nobody-has-used-this-bucket-name-yet-asdfsd123"
acl = "private"
force_destroy = true

server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
kms_master_key_id = aws_kms_key.some_encryption_key.arn
sse_algorithm = "aws:kms"
}
}
}
}

data "aws_iam_policy_document" "encrypted_bucket_policy_document" {
statement {
sid = "PutGetObjectAccess"
actions = [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation"
]
resources = ["${aws_s3_bucket.some_encrypted_bucket.arn}/*",
"${aws_s3_bucket.some_encrypted_bucket.arn}"]
condition {
test = "Bool"
values = ["true"]
variable = "aws:SecureTransport"
}
principals {
type = "AWS"
# Put another account id here to make this tf code run. Make it a different
# account to the one that created the bucket.
identifiers = ["arn:aws:iam:::root"]
}
effect = "Allow"
}
}

resource "aws_s3_bucket_policy" "encrypted_bucket_policy" {
bucket = aws_s3_bucket.some_encrypted_bucket.id
policy = data.aws_iam_policy_document.encrypted_bucket_policy_document.json
}

resource "aws_s3_bucket_public_access_block" "some_bucket_access_block" {
bucket = aws_s3_bucket.some_encrypted_bucket.id

block_public_acls = true
block_public_policy = true

restrict_public_buckets = true
ignore_public_acls = true
}
```

Once you've created the resources above, try copying something to/from the bucket with the separate account that the terraform granted access to. The error message will make no reference to the user not having the required `kms` permissioning.

**Expected behavior**
In previous versions of the CLI (e.g. 1.18.210) the error is more helpful, since it actually makes a reference to a customer managed key. E.g.:

```
The ciphertext refers to a customer master key that does not exist, does not exist
in this region, or you are not allowed to access.
```

**Logs/output**
[s3-no-kms-perms-log.txt](https://github.com/aws/aws-cli/files/8050001/s3-no-kms-perms-log.txt)
Note how there are also no references to kms-permissioning-related errors here either.

**Additional context**
It would have been much harder to debug the underlying issue we were troubleshooting, if one of us didn't happen have an older version of the aws cli (which emitted an error that mentioned kms).