Aws-cdk: BucketDeployment: invalid system metadata keys `server-side-encryption` and `ssekms-key-id`

[pnwpedro]

Setting props serverSideEncryption or serverSideEncryptionAwsKmsKeyId results in a failure to deploy.

Reproduction Steps

const encryptionKey = new kms.Key(this, "ArtifactKey");
const artifactBucket = new s3.Bucket(this, "artifactBucket", { encryptionKey });

new s3deploy.BucketDeployment(this, "ArtifactPreparation", {
   sources: [s3deploy.Source.asset(path.resolve(__dirname, '../assets'))],
   destinationBucket: artifactBucket,
   serverSideEncryption: ServerSideEncryption.AWS_KMS,
   serverSideEncryptionAwsKmsKeyId: encryptionKey.keyId
});

Error Log

From lambda:

Unknown options: --server-side-encryption 'aws:kms',--ssekms-key-id 'redacted-key-id'

Command '['python3', '/var/task/aws', 's3', 'sync', '--delete', '/tmp/tmpgvs36uzh/contents', 's3://foo-bucket/', "--server-side-encryption 'aws:kms'", "--ssekms-key-id 'redacted-key-id'", '--metadata-directive', 'REPLACE']' returned non-zero exit status 255

Environment

• CLI Version : 1.21.1

• Framework Version: 1.21.1

• Language : typescript

Other

Invalid system metadata keys:

• https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts#L265
• https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-s3-deployment/lib/bucket-deployment.ts#L268

From documentation, these should be:

• sse
• sse-kms-key-id

System metadata keys usage to construct the s3 sync operation here:
https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-s3-deployment/lambda/src/index.py#L156

---

This is :bug: Bug Report

[mattsains]

I am working on a fix, but it's my first time contributing to the cdk so it will take a while for me to test it successfully.

[SomayaB]

Hi @pnwpedro, thanks for reporting this. And thanks @mattsains for working on it, much appreciated! 👍