What is the problem?

When publishing assets to the assets bucket, the files are not encrypted using the same KMS key as the default encryption method of the bucket. If the buckets' default encryption is set to KMS with a Customer Managed key, the objects will be encrypted with the AWS Managed key. This will make it impossible to shared the objects with the rest of the Organizational accounts. In this case it is not possible to deploy a stackset with assets.

Reproduction Steps

Create the bootstrapping stack with a KMS key:
cdk bootstrap --bootstrap-kms-key-id '' aws:///

This will create a bucket that uses a new Customer Managed key as default encryption (not AWS_MANAGED_KEY)

Create a cdk app with assets and synthesize the app.

Publish assets:
cdk-assets publish --path cdk.out/-.assets.json

What did you expect to happen?

The objects should be encrypted with the Customer managed key.

What actually happened?

The object are encrypted with the AWS Managed KMS Key

CDK CLI Version

2.3.0

Framework Version

No response

Node.js Version

16

OS

Mac

Language

Typescript

Language Version

No response

Other information

I think the behaviour changed with the following change:
8191f1f#diff-1f59ad129e9c6ce901748465a75693927875be1babb51d0f0871530c31678842

If I remove the s3:GetEncryptionConfiguration permissions, objects will be uploaded using the proper default encryption method (without the encryption header).