S3 bucket encryption restriction in IAM policy

Question

I am trying to use the following impose Deny on unencrypted bucket creation. The user with the policy has full S3 and KMS apart from the below policy.

I get this red warning:

This policy does not grant any permissions. To grant access, policies must have an action that has an applicable resource or condition.

Further, I am denied access to create an S3 bucket, encrypted or unencrypted.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Deny",
        "Action": "s3:CreateBucket",
        "Resource": "arn:aws:s3:::*",
        "Condition": {
            "StringNotEquals": {
                "s3:x-amz-server-side-encryption": [
                    "AES256",
                    "aws:kms"
                ]
            }
        }
    }
]
}

Reason for doing is to not worry about the object encrypt once the bucket is encrypted.

Default Encryption – You can mandate that all objects in a bucket must be stored in encrypted form without having to construct a bucket policy that rejects objects that are not encrypted. Referred: https://aws.amazon.com/blogs/aws/new-amazon-s3-encryption-security-features/

Answer 1

Condition Key is invalid.

s3:CreateBucket operation can have only certain conditions while writing a policy and s3:x-amz-server-side-encryption is not one of them.

Refer: https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html#bucket-keys-in-amazon-s3-policies