title: s3.copyObject does not apply ServerSideEncryption to object in target bucket?
body: <p>I'm attempting to perform cross-account backups of any objects from one bucket on <code>ACCOUNT-A</code> to a backup bucket on <code>ACCOUNT-B</code> and I want the objects in the backup bucket to be encrypted using <code>AES256</code>. But the encryption doesn't seem to be getting applied to the objects that land in the backup bucket.</p>
  
  <p><strong>The Setup</strong></p>
  
  <ul>
  <li><code>ACCOUNT-A</code> has a source bucket called <code>assets.myapp.com</code></li>
  <li><code>ACCOUNT-B</code> has a target bucket called <code>backup-assets.myapp.com</code></li>
  <li>An <code>s3.ObjectCreated:*</code> bucket event on the <code>assets.myapp.com</code> bucket triggers a Lambda function to copy the newly created object to the <code>backup-assets.myapp.com</code> bucket under <code>ACCOUNT-B</code>.</li>
  <li>Attempting to apply <code>ServerSideEncryption: 'AES256'</code> to the objects in the <code>backup-assets.myapp.com</code> bucket once they land there.</li>
  </ul>
  
  <p><strong>The Lambda Function Code</strong></p>
  
  <pre><code>var async = require('async');
  var aws = require('aws-sdk');
  var s3 = new aws.S3({ apiVersion: '2006-03-01' });
  
  exports.backupObject = function backupS3Object(event, context) {
  
      if (event.Records === null) {
          return context.fail('NOTICE:', 'No records to process.');
      }
  
      async.each(event.Records, function(record, iterate) {
  
          var sourceBucket = record.s3.bucket.name;
          var targetBucket = 'backup-' + record.s3.bucket.name;
          var key = record.s3.object.key;
  
          s3.copyObject({
              Bucket : targetBucket,
              CopySource : sourceBucket + '/' + key,
              Key : key,
              ACL : 'private',
              ServerSideEncryption : 'AES256',
              MetadataDirective : 'COPY',
              StorageClass : 'STANDARD_IA'
          }, function(error, data) {
  
              if (error) return iterate(error);
              console.log('SSE: ' + data.ServerSideEncryption);
              console.log('SUCCESS: Backup of ' + sourceBucket + '/' + key);
              return iterate();
  
          });
  
      }, function (error) {
  
          if (error) {
              return context.fail('ERROR:', 'One or more objects could not be copied.');
          }
  
          return context.done();
  
      });
  
  };
  </code></pre>
  
  <p><strong>Cloudwatch Log Reports Success</strong></p>
  
  <p>When the function runs, the object is successfully copied, and the Cloudwatch Log for my Lambda function reports the <code>ServerSideEncryption</code> used as <code>AES256</code>.</p>
  
  <p><strong>However, The S3 Console Disagrees</strong></p>
  
  <p>But the problem is that when I inspect the <code>Properties &gt; Details</code> of the copied object in the <code>backup-assets.myapp.com</code> bucket under <code>ACCOUNT-B</code> it reports <code>Server Side Encryption: None</code>.</p>
  
  <p>Any idea why the <code>SSE</code> doesn't seem to be applied to the object when it lands in the <code>backup-assets.myapp.com</code> bucket? Or is it actually being applied and I've just discovered a display bug in the <code>S3 Console</code>?</p>
  
  <blockquote>
    <p><strong>BONUS QUESTION</strong></p>
    
    <p>When I attempt to apply <code>SSE:AES256</code> to any given object manually
    using the console, I get the following error: <code>The additional
    properties (RRS/SSE) were not enabled or disabled due to errors for
    the following objects in backup-assets.myapp.com:
    copied-object-one.txt.</code></p>
  </blockquote>
  
  <p>Thanks in advance for any help.</p>