[cli] deploy cannot specify S3 SSE for asset upload

Reproduction Steps

1. cdk bootstrap with legacy bootstrap, provide kms key id as param
2. have a SCP setup that denies s3:PutObject if s3:x-amz-server-side-encryption is missing
3. create a CDK app that provisions a lambda asset
4. execute cdk deploy
5. deploy fails and receive Access Denied error

What did you expect to happen?

i expect CDK deploy to explicitly use the kms key i specified in the bootstrap when uploading assets.

What actually happened?

cdk deploy does not provide SSE and the deploy fails with Access Denied. It appears to be relying on the S3 default encryption instead of specifying the SSE options to the S3 put object request.

Environment

• CLI Version : 1.71.0
• Framework Version:
• Node.js Version: v12.16.1
• OS : Windows 10
• Language (Version): Python 3.8.5

Other

---

This is 🐛 Bug Report

[openfinch]

Adding onto this, this is a strange feature to leave out considering it exists in other AWS-provided tools. This is a fairly common SCP in larger environments.

[cagdas-carbon]

Are there any plans on adding an argument to cdk deploy to fix this?