example s3 bucket policy with kms enforced

policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::prod-secrets/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms",
                    "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789123:key/big-long-4part-guid"
                }
            }
        },
        {
            "Sid": "AllowedUsers",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789123:user/jbuss"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::prod-secrets",
                "arn:aws:s3:::prod-secrets/*"
            ]
        },
        {
            "Sid": "AllowedRoles",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::987654321098:role/AnotherAccountRole"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::prod-secrets",
                "arn:aws:s3:::prod-secrets/*"
            ]
        }
    ]
}