将文件上传到 KMS 加密的 S3 存储桶

Question

如果标头与策略中指定的字符串不匹配，则 buckey 策略具有拒绝操作。 我正在尝试此代码，但在上传到 S3 时出现访问被拒绝的错误。 也试过包括 SSEKMSKeyId。

import boto3
s3_client = boto3.client('s3', config=Config(signature_version='s3v4'))

s3_client.put_object(Body=open(Source, 'rb'),
                             Bucket=Bucket,
                             Key=Sink,
                             ServerSideEncryption='aws:kms',
                             Metadata={'x-amz-server-side-encryption-aws-kms-key-id':'9999999999999'})


Bucket Policy 

"Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:putObject",
            "Resource": "bucket-name/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-west-#:########:key/9999999999999"
                }