s3: lazy-evaluate encryption policy

[justinsb]

Should help performance a little bit, and should be a little faster.

[rdrgmnzs]

Thanks @justinsb

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, rdrgmnzs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[xanonid]

Could it be, that the master IAM S3 Bucket Policy needs to be adapted? We get Access Denied warnings since upgrade to kops 1.10 related to access to GetBucketEncryption of the kops bucket. The master policy allows only GetBucketLocation and ListBucket.

The needed permission is called s3:GetEncryptionConfiguration.

[rdrgmnzs]

@xanonid could you open an issue for this if you have not done so already. It would also be really helpful if possible to include the entire error/warning output.