title: S3 bucket encryption restriction in IAM policy
body: <p>I am trying to use the following impose Deny on unencrypted bucket creation. The user with the policy has full S3 and KMS apart from the below policy.</p>
  
  <p>I get this red warning:</p>
  
  <p><code>This policy does not grant any permissions. To grant access, policies must have an action that has an applicable resource or condition.</code></p>
  
  <p>Further, I am denied access to create an S3 bucket, encrypted or unencrypted. </p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Deny",
          "Action": "s3:CreateBucket",
          "Resource": "arn:aws:s3:::*",
          "Condition": {
              "StringNotEquals": {
                  "s3:x-amz-server-side-encryption": [
                      "AES256",
                      "aws:kms"
                  ]
              }
          }
      }
  ]
  }
  </code></pre>
  
  <p>Reason for doing is to not worry about the object encrypt once the bucket is encrypted. </p>
  
  <blockquote>
    <p>Default Encryption – You can mandate that all objects in a bucket must
    be stored in encrypted form without having to construct a bucket
    policy that rejects objects that are not encrypted. 
    Referred: <a href="https://aws.amazon.com/blogs/aws/new-amazon-s3-encryption-security-features/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/aws/new-amazon-s3-encryption-security-features/</a></p>
  </blockquote>