title: Require KMS encryption with specific key ID in S3 bucket policy
body: <p>I'm trying to require all objects put into a bucket to be encrypted with a specific KMS key. I've managed to require KMS encryption, but the key specification does not work. Here is the current policy I have (sans real bucket names and ids):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "PutObjPolicy",
      "Statement": [
          {
              "Sid": "DenyInsecureCommunications",
              "Effect": "Deny",
              "Principal": {
                  "AWS": "*"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::bucket1,
              "Condition": {
                  "Bool": {
                      "aws:SecureTransport": "false"
                  }
              }
          },
          {
              "Sid": "DenyIncorrectEncryptionHeader",
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:PutObject",
              "Resource": "arn:aws:s3:::bucket1/*",
              "Condition": {
                  "StringNotEquals": {
                      "s3:x-amz-server-side-encryption": "aws:kms",
                      "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:eu-central-1:123456789:key/12345-123-notmy-keyid-1234566"
                  }
              }
          },
  
          {
              "Sid": "DenyUnEncryptedObjectUploads",
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:PutObject",
              "Resource": "arn:aws:s3:::bucket1/*",
              "Condition": {
                  "Null": {
                      "s3:x-amz-server-side-encryption": "true"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>This correctly denies uploads without any sever-side encryption specified, but it still allows using the default s3 key.</p>