Given that OAC supports SSE-KMS
and the implementation relies on the administrator changing the S3 bucket policy manually, i’m not sure why AWS require this?
the policy JSON i was referring to is for IAM. However, the S3 bucket policy appears to be irrelevant?