title: S3 default SSE with KMS still requires a parameter for aws-cli
body: <p>I've created an S3 bucket and configured default SSE to use KMS.</p>
  
  <p>I can upload a file to the bucket with <code>aws-cli</code> provided I pass the <code>--sse aws:kms</code> flag, e.g.:
  <code>
  aws s3 cp --sse aws:kms test.txt s3://my-bucket
  </code></p>
  
  <p>But I expect this to work without the <code>--sse aws:kms</code> flag since this is default encryption, i.e. it should be applied when no encryption header is specified.</p>
  
  <p>When I try without the header it fails:
  <code>
  aws s3 cp test.txt s3://my-bucket
  </code>
  <code>
  upload failed: ./test.txt to s3://my-bucket/test.txt An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
  </code></p>
  
  <p>If I change from using AWS KMS to S3-managed SSE it works without any <code>--sse</code> flag, but I need to use AWS KMS. I've tried adding the following policy to my IAM user making the request but it still fails:
  <code>
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "s3:*",
                  "kms:*"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket",
                  "arn:aws:s3:::my-bucket/*",
                  "arn:aws:kms:eu-west-2:1111112222:key/aaaabbbb-1122-2222-4444-eeeeff3333"
              ]
          }
      ]
  }
  </code></p>
  
  <p>What am I missing to get this working?</p>