s3 encryption with troposphere

bucket.py

import os
from troposphere import Template, NoValue

from troposphere import s3


key_id = os.getenv("BUCKET_ENCRYPTION_KEY_ID")

bucket_encryption = NoValue

if key_id:
    bucket_encryption = s3.BucketEncryption(
        ServerSideEncryptionConfiguration=[
            s3.ServerSideEncryptionRule(
                ServerSideEncryptionByDefault=s3.ServerSideEncryptionByDefault(
                    KMSMasterKeyID=key_id,
                    SSEAlgorithm="aws:kms",
                )
            )
        ]
    )

t = Template()

t.add_resource(
    s3.Bucket(
        "ExternalBucket",
        BucketEncryption=bucket_encryption,
    )
)

print t.to_yaml()

output

$ python bucket.py
Resources:
  ExternalBucket:
    Properties:
      BucketEncryption: !Ref 'AWS::NoValue'
    Type: AWS::S3::Bucket

$ BUCKET_ENCRYPTION_KEY_ID="123456789abcdef" python bucket.py
Resources:
  ExternalBucket:
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: 123456789abcdef
              SSEAlgorithm: aws:kms
    Type: AWS::S3::Bucket