Enforce KMS Customer Managed Key for SAP HANA S3 Backups

Quick Answer

Enforcing a specific encryption key through an S3 bucket policy relies on condition keys that let you inspect the actual headers of an incoming request and deny anything that doesn't match your requirement. The s3:x-amz-server-side-encryption-aws-kms-key-id condition key does exactly that: it checks the value of the corresponding header on the request, which identifies which specific KMS key was used for encryption, and lets the bucket policy allow or deny the request based on whether that value matches the customer managed key you want enforced. This is more precise than simply requiring some form of server-side encryption, because it locks the requirement down to one exact key rather than allowing any KMS key or the default S3-managed key to satisfy the condition. For SAP HANA backups specifically, this level of control matters because backup data is highly sensitive, and an organization typically wants a guarantee that only a designated, auditable customer managed key was used to encrypt it, rather than trusting that whoever configured the backup job happened to specify the correct key. The general principle to take away is that S3 bucket policies can enforce very granular encryption requirements by matching against specific request headers via condition keys, and whenever a question asks how to lock down encryption to one particular KMS key rather than just any encryption, the answer will be a condition key that references the KMS key ID header specifically.