Another week, another resource control policy! I guess this is what IAM geeks do. 😹 github.com/sqlxpert/aws-rcp-s3-require-encryption-kms …is my new way to replace KMS encryption statements potentially repeated in hundreds of S3 bucket policies. • Install it in your AWS Organizations management account, with CloudFormation or native Terraform. • Tag an S3 bucket and enable attribute-based access control (ABAC) for the bucket.

security-s3-require-encryption-kms-key-arn

= ARN of KMS key required in this bucket (Two other identifiers are also supported. One is for the simplest setups, in which S3 bucket and KMS key are only ever used in one region and AWS account. The other fits KMS multi-region keys defined in a central AWS account.) • Any attempt to create an object with the wrong encryption type or wrong KMS key yields

AccessDenied

. • An optional service control policy locks the tag. Between the resource control policy itself, the automated test stack (CloudFormation only, because it's temporary), and the documentation, there's lots of information about: • New 2025–2026 S3 features (attribute-based access control, account-regional namespaces) • IAM policy condition keys for tags, and condition operator semantics • Secure, future-proof KMS key configurations I really appreciate your feedback, and that's not an empty statement: I improve stuff based on user requests, and I of course acknowledge the source. I hope this will be useful. If you give it a try, thank you!