title: How do you use Boto3 download_file with AWS KMS?
body: <p>I have very simple script that downloads a file from a bucket. The file is leveraging KMS encrypted keys, my policies and roles are setup correctly but I still get an error. </p>
  
  <p><strong>Code</strong></p>
  
  <pre><code>#!/usr/bin/env python
  import boto3
  s3_client = boto3.client('s3')
  s3_client.download_file('testtesttest', 'test.txt', '/tmp/test.txt')
  </code></pre>
  
  <p><strong>Error</strong></p>
  
  <pre><code>Traceback (most recent call last):
    File "./getfile.py", line 4, in &lt;module&gt;
  s3_client.download_file('testtesttest', 'test.txt', '/tmp/test.txt')
  File "/usr/local/lib/python2.7/dist-packages/boto3/s3/inject.py", line 91, in download_file
  extra_args=ExtraArgs, callback=Callback)
  File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 659, in download_file
  extra_args, callback)
  File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 674, in _download_file
  self._get_object(bucket, key, filename, extra_args, callback)
  File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 698, in _get_object
  extra_args, callback)
  File "/usr/local/lib/python2.7/dist-packages/boto3/s3/transfer.py", line 712, in _do_get_object
  **extra_args)
  File "/usr/local/lib/python2.7/dist-packages/botocore/client.py", line 301, in _api_call
  return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python2.7/dist-packages/botocore/client.py", line 386, in _make_api_call
  raise ClientError(parsed_response, operation_name)
  botocore.exceptions.ClientError: An error occurred (InvalidArgument) when calling the GetObject operation: Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.
  </code></pre>