Make bucket encryption optional for bootstrap

[ConradMearns]

As a developer operating in a federated AWS space, I need to be able to bootstrap the CDK without it attempting to set s3:SetBucketEncryption properties.

Use Case

When attempting to run cdk bootstrap, cdk bootstrap --without-public-access-block-configuration, cdk bootstrap --public-access-block-configuration true or cdk bootstrap --public-access-block-configuration false, the creation of the StagingBucket fails with the error API: s3:SetBucketEncryption Access Denied - I am using credentials with CDK admin privileges, but I suspect it fails because my organization has revoked the ability to modify this property on all buckets.

Proposed Solution

Similarly to #5028 , we need a way to defer encryption to the defaults set by the organization.

cdk bootstrap --skip "s3:SetBucketEncryption"

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[shivlaks]

@ConradMearns There was a bug in disabling the public-access-block-configuration implementation.

just wanted to confirm whether the fix shipped in #8755 would work for your use case or whether the entire property needs to be omitted. From the sounds of it, it seems like it might, but I haven't quite tested that yet myself.

[ConradMearns]

I got around the issue by cloning aws-cdk and removing

aws-cdk/packages/aws-cdk/lib/api/bootstrap/legacy-template.ts

Lines 19 to 26 in d2ae4bc

	BucketEncryption: {
	ServerSideEncryptionConfiguration: [{
	ServerSideEncryptionByDefault: {
	SSEAlgorithm: 'aws:kms',
	KMSMasterKeyID: params.kmsKeyId,
	},
	}],
	},

It doesn't look like this has a toggle available yet, and nothing in #8755 :(

After more research within my org, it turns out that our admins have SCP's that force encryption everywhere, and they have banned all of us sub-admins from making any changes to those policies, so it's definitely worth having a flag to skip this config.

[shivlaks]

@ConradMearns thanks for the quick response. seems like this is certainly a feature request as there's currently no path forward for you without having to muck around with the template

so the entire BucketEncryption key is problematic and not just properties within it.