So the root cause is this:
- Customer AWS account uses KMS CMK encryption key on the EBS service & mandates EBS encryption at rest
- HeadNode can't launch EC2 fleet actions via API because it lacks the KMS key usage permission to deal with encrypted EBS disk volumes
