Using KMS with S3 in Cyberduck, blog post etc say that IAM permissions required are kms:ListKeys.

​https://trac.cyberduck.io/wiki/help/en/howto/s3

In addition though, you also need kms:ListAliases for it to populate the Encryption drop down appropriately.

i.e. an IAM Policy (in addition to the appropriate S3 permissions) of -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1467393289000",
            "Effect": "Allow",
            "Action": [
                "kms:ListKeys",
                "kms:ListAliases"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}