title: Unable to set Cross Region Replication on S3 bucket with SSE
body: <p>I am not able to setup Cross Region Replication when the objects are server side encrypted. I am using awscli to set it up. This is what I have done.</p>
  
  <p>Cross region replication role IAM policy looks like this:</p>
  
  <pre><code>{
  
  
     "Version":"2012-10-17",
     "Statement":[
        {
           "Effect":"Allow",
           "Action":[
              "s3:GetReplicationConfiguration",
              "s3:ListBucket"
           ],
           "Resource":[
              "arn:aws:s3:::source-bucket"
           ]
        },
        {
           "Effect":"Allow",
           "Action":[
  
              "s3:GetObjectVersion",
              "s3:GetObjectVersionAcl",
              "s3:GetObjectVersionTagging"
  
           ],
           "Resource":[
              "arn:aws:s3:::source-bucket/*"
           ]
        },
        {
           "Effect":"Allow",
           "Action":[
              "s3:ReplicateObject",
              "s3:ReplicateDelete",
              "s3:ReplicateTags"
           ],
           "Resource":"arn:aws:s3:::destination-bucket/*"
        }
     ]
  }
  </code></pre>
  
  <p>This is how my replication configuration file looks like:</p>
  
  <pre><code>{
      "Role": "arn:aws:iam::1234567890:role/replication-role",
      "Rules": [
          {
              "ID": "abcd",
              "Prefix": "",
              "Status": "Enabled",
              "SourceSelectionCriteria": {
                  "SseKmsEncryptedObjects": {
                      "Status": "Enabled"
                  }
              },
              "Destination": {
                  "Bucket": "arn:aws:s3:::destinationbucket",
                  "EncryptionConfiguration": {
                      "ReplicaKmsKeyID": "arn:aws:kms:us-west-2:1234567890:key/849b779d-bdc3-4190-b285-6006657a578c"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>This is how my cli command looks like:</p>
  
  <pre><code>aws s3api put-bucket-replication --bucket "sourcebucket" --replication-configuration  file://./replicationconfigfile.json
  </code></pre>
  
  <p>When I go to S3 bucket after running the cli command, I can see the replication rule being created with <code>KMS-Encrypted Object</code> as <code>replicate</code> but when i click on <code>edit</code> to see the details, it does not have any KMS keys selected.</p>
  
  <p>------Update-------</p>
  
  <p>if i delete the rule created by cli and set it up using console, it selects all the kms keys in the wizard. So the question is why is it not selecting kms keys in source region when I am using cli? 
  what am I missing here?</p>