AWS S3 Bucket Policy: Require TLS for data transport, enforce object encryption using any KMS key

aws-s3-bucket-policy-tls-kms-enforcement.json

{
  "Version": "2012-10-17",
  "Id": "PolicyIdentifierGUIDgoesHere",
  "Statement": [{
    "Action": "s3:*",
    "Effect": "Deny",
    "Principal": "*",
    "Resource": "arn:aws:s3:::<bucketname>",
    "Condition": {
      "Bool": {
        "aws:SecureTransport": false
      }
    }
  }, {
    "Action": "s3:*",
    "Effect": "Deny",
    "Principal": "*",
    "Resource": "arn:aws:s3:::<bucketname>/*",
    "Condition": {
      "Bool": {
        "aws:SecureTransport": false
      }
    }
  }, {
    "Sid": "DenyIncorrectEncryptionHeader",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::<bucket_name>/*",
    "Condition": {
      "StringNotEquals": {
        "s3:x-amz-server-side-encryption": "aws:kms"
      }
    }
  }, {
    "Sid": "DenyUnEncryptedObjectUploads",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::<bucket_name>/*",
    "Condition": {
      "Null": {
        "s3:x-amz-server-side-encryption": true
      }
    }
  }]
}