VED-1029: Specify SSE via KMS when a KMS key ID is specified.

mfjarvis · mfjarvis · commit cb4166cfcef8 · 2026-02-11T22:53:09.000Z
diff --git a/lambdas/shared/src/common/aws_s3_utils.py b/lambdas/shared/src/common/aws_s3_utils.py
@@ -33,6 +33,7 @@ def copy_file_to_external_bucket(
     }
 
     if sse_kms_key_id:
+        copy_params["ServerSideEncryption"] = "aws:kms"
         copy_params["SSEKMSKeyId"] = sse_kms_key_id
 
     s3_client = get_s3_client()

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ def copy_file_to_external_bucket(`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`if sse_kms_key_id:`
	`36`	`+ copy_params["ServerSideEncryption"] = "aws:kms"`
`36`	`37`	`copy_params["SSEKMSKeyId"] = sse_kms_key_id`
`37`	`38`
`38`	`39`	`s3_client = get_s3_client()`