Reproduction Steps

1. cdk bootstrap with legacy bootstrap, provide kms key id as param
2. have a SCP setup that denies s3:PutObject if s3:x-amz-server-side-encryption is missing
3. create a CDK app that provisions a lambda asset
4. execute cdk deploy
5. deploy fails and receive Access Denied error

What did you expect to happen?

i expect CDK deploy to explicitly use the kms key i specified in the bootstrap when uploading assets.

What actually happened?

cdk deploy does not provide SSE and the deploy fails with Access Denied.
It appears to be relying on the S3 default encryption instead of specifying the SSE options to the S3 put object request.

Environment

• CLI Version : 1.71.0
• Framework Version:
• Node.js Version: v12.16.1
• OS : Windows 10
• Language (Version): Python 3.8.5

Other

This is 🐛 Bug Report