Reject S3 uploads without server-side encryption

[jmcarp]

Buckets that must be encrypted should reject uploads that don't specify server-side encryption. Example policy: http://s3tools.org/kb/item11.htm

• [ ] Blobstores
• [x] Platform (buildpacks, droplets, etc)
• [ ] Buckets managed by concourse (stemcell, bosh releases)
• [ ] Secrets buckets (cloud-gov-varz, concourse-credentials)
• [ ] Terraform state

[jmcarp]

https://github.com/18F/cg-provision/pull/46

[jmcarp]

Bucket policies are set correctly, and uploads without sse are rejected:

[rogeruiz]

👍