**Use case**
With S3, you have to send the header `x-amz-server-side-encryption-customer-key` and `x-amz-server-side-encryption-customer-key-md5` if the resource is server side encrypted.

https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeysSSEUsingRESTAPI.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html

**Describe the solution you'd like**
Ability to set this in the query.
Aws::Http::HttpRequest & request,
        const char * region,
        const char * service_name,
        long long expiration_time_sec) const override 
    {
        auto result = Aws::Client::AWSAuthV4Signer::PresignRequest(request, region, service_name, expiration_time_sec);
        for (const auto & header : headers)
            request.SetHeaderValue(header.name, header.value);
        return result;
    }
private:
    const DB::HeaderCollection headers;
};
}
namespace DB
{
namespace ErrorCodes
{
    extern const int BAD_ARGUMENTS;
}
namespace S3
{
    ClientFactory::ClientFactory()
    {
        aws_options = Aws::SDKOptions{};
        Aws::InitAPI(aws_options);
        Aws::Utils::Logging::InitializeAWSLogging(std::make_shared<AWSLogger>());
        Aws::Http::SetHttpClientFactory(std::make_shared<PocoHTTPClientFactory>());
    }
    ClientFactory::~ClientFactory()