Okay one more issue many users facing is how to test if your encryption is working properly or not, isn’t it ? okay here is my second and most useful usecase 
Edit /usr/kms-demo/hadoop/etc/hadoop/kms-acls.xml and set below property :
<property>
<name>hadoop.kms.acl.DECRYPT_EEK</name>
<value>user1,user2</value>
<description>
ACL for decryptEncryptedKey CryptoExtension operations.
</description>
</property>
Add list of users for whom you want to give access to your encrypted zone.