### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

Creating a Bedrock batch requires litellm to first upload the batch input file to S3. When the target S3 bucket enforces **SSE-KMS** (server-side encryption with a customer-managed KMS key) via bucket policy, the upload fails, because the KMS key configured on the credential is never passed through to the actual S3 `PutObject` call's encryption parameters.

**Best-effort root cause (please confirm/correct):** the KMS key field appears to be filtered out of the credential params object used for the batch file upload path (`CredentialLiteLLMParams` or equivalent) before it reaches the S3 upload call, so even when a KMS key is explicitly configured, it never makes it into the request.

### Impact

This is a **hard blocker**, not a minor inconvenience — for any organization whose S3 buckets require SSE-KMS by policy (as ours do), Bedrock batches cannot be created at all against those buckets, regardless of how the credential/model is configured. There is no workaround short of relaxing the bucket's encryption policy, which is not an option for us. …