Describe the bug

bucketKeyEnabled not allowed when the encryption is SSE-S3.

But there's no document about this restriction and CloudFormation and console actually allow you to specify that.

Workaround:

    // create a s3 bucket with SSE
    const bucket = new s3.Bucket(this, 'Bucket', {
      encryption: s3.BucketEncryption.S3_MANAGED,
    });
    (bucket.node.defaultChild as s3.CfnBucket).addPropertyOverride('BucketEncryption.ServerSideEncryptionConfiguration.0.BucketKeyEnabled', true)

Expected Behavior

Allows BucketEncryption with SSE-S3.

Current Behavior

not allowed

Reproduction Steps

 const bucket = new s3.Bucket(this, 'Bucket', {
      encryption: s3.BucketEncryption.S3_MANAGED,
      bucketKeyEnabled: true,
    });

Possible Solution

fix the logic here

Additional Information/Context

No response

CDK CLI Version

v2.141.0

Framework Version

No response

Node.js Version

all

OS

all

Language

TypeScript

Language Version

No response

Other information

No response