s3: bucketKey should support SSE-S3

[pahud]

Describe the bug

bucketKeyEnabled not allowed when the encryption is SSE-S3.

aws-cdk/packages/aws-cdk-lib/aws-s3/test/bucket.test.ts

Lines 577 to 587 in 65f2bd9

	test('throws error if bucketKeyEnabled is set, but encryption is not KMS', () => {
	const stack = new cdk.Stack();
	expect(() => {
	new s3.Bucket(stack, 'MyBucket', { bucketKeyEnabled: true, encryption: s3.BucketEncryption.S3_MANAGED });
	}).toThrow("bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: S3_MANAGED)");
	expect(() => {
	new s3.Bucket(stack, 'MyBucket3', { bucketKeyEnabled: true });
	}).toThrow("bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: UNENCRYPTED)");
	});

But there's no document about this restriction and CloudFormation and console actually allow you to specify that.

Workaround:

    // create a s3 bucket with SSE
    const bucket = new s3.Bucket(this, 'Bucket', {
      encryption: s3.BucketEncryption.S3_MANAGED,
    });
    (bucket.node.defaultChild as s3.CfnBucket).addPropertyOverride('BucketEncryption.ServerSideEncryptionConfiguration.0.BucketKeyEnabled', true)

Expected Behavior

Allows BucketEncryption with SSE-S3.

Current Behavior

not allowed

Reproduction Steps

 const bucket = new s3.Bucket(this, 'Bucket', {
      encryption: s3.BucketEncryption.S3_MANAGED,
      bucketKeyEnabled: true,
    });

Possible Solution

fix the logic here

aws-cdk/packages/aws-cdk-lib/aws-s3/lib/bucket.ts

Lines 2130 to 2136 in 65f2bd9

	// if bucketKeyEnabled is set, encryption must be set to KMS or DSSE.
	if (
	props.bucketKeyEnabled &&
	![BucketEncryption.KMS, BucketEncryption.KMS_MANAGED, BucketEncryption.DSSE, BucketEncryption.DSSE_MANAGED].includes(encryptionType)
	) {
	throw new Error(`bucketKeyEnabled is specified, so 'encryption' must be set to KMS or DSSE (value: ${encryptionType})`);
	}

Additional Information/Context

No response

CDK CLI Version

v2.141.0

Framework Version

No response

Node.js Version

all

OS

all

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

internal tracking - V1376578494

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.