Update "--output-dir s3://.. to include the KMS key"

[satvan23]

Update: ( After some more testing ).

1. The usual option to write to s3 bucket was working until Security team changed the bucket policy.
2. So, now I need an option to include the KMS key I have in "--output-dir s://..." ( like I see in s3cmd )
   ( s3cmd --server-side-encryption-kms-id=KMS_KEY )
3. Does the option to write to S3 use https ? If not then that is needed.
4. I can do a s3 cp without giving any KMS option, so https is used.

Thanks

[kapilt]

couple of followup questions

1. is the default kms s3 service key sufficient?
2. does this need to be able to specify custom kms key?
3. if so, does it need to be specify by key alias, or key id?
4. does encryption context need to be provided?

[satvan23]

1 & 2 Unfortunately no, company policy is for custom kms key. Not the default one
3. Alias is good
4. Looking at the list of keys, all are "SYMMETRIC_DEFAULT"