Repository: cloud-custodian/cloud-custodian

Issue:
AWS: Lambda Layer + Cross-Account filter
the bug:
`botocore.errorfactory.ResourceNotFoundException: An error occurred (ResourceNotFoundException) when calling the GetLayerVersionPolicy operation: No policy is associated with the given resource`

it looks like custodian is not able to make a GetLayerVersionPolicy API call. 

**Background (please complete the following information):**
 - OS: Mac OS Catalina
 - Python Version: 3.7.3
 - Custodian Version: 0.9.10
 - Cloud Provider: aws
```yaml
policies: 
   - name: lambda-layer-cross-account
      resource: aws.lambda-layer
      filters:
      - type: cross-account
```


Discussion:

Patch:
diff --git a/c7n/resources/awslambda.py b/c7n/resources/awslambda.py
index b053ccfb7..f2c2b7742 100644
--- a/c7n/resources/awslambda.py
+++ b/c7n/resources/awslambda.py
@@ -644,10 +644,16 @@ class LayerCrossAccount(CrossAccountAccessFilter):
     def process(self, resources, event=None):
         client = local_session(self.manager.session_factory).client('lambda')
         for r in resources:
-            r['c7n:Policy'] = self.manager.retry(
-                client.get_layer_version_policy,
-                LayerName=r['LayerName'],
-                VersionNumber=r['Version']).get('Policy')
+            if 'c7n:Policy' in r:
+                continue
+            try:
+                rpolicy = self.manager.retry(
+                    client.get_layer_version_policy,
+                    LayerName=r['LayerName'],
+                    VersionNumber=r['Version']).get('Policy')
+            except client.exceptions.ResourceNotFoundException:
+                rpolicy = {}
+            r['c7n:Policy'] = rpolicy
         return super(LayerCrossAccount, self).process(resources)
 
     def get_resource_policy(self, r):
diff --git a/c7n/resources/s3.py b/c7n/resources/s3.py
index 14fc49c6e..516a2ecb2 100644
--- a/c7n/resources/s3.py
+++ b/c7n/resources/s3.py
@@ -3139,7 +3139,8 @@ class KMSKeyResolverMixin:
         self.manager = manager
 
     def resolve_keys(self, buckets):
-        if 'key' not in self.data:
+        key = self.data.get('key')
+        if not key:
             return None
 
         regions = {get_region(b) for b in buckets}
@@ -3147,9 +3148,14 @@ class KMSKeyResolverMixin:
             client = local_session(self.manager.session_factory).client('kms', region_name=r)
             try:
                 key_meta = client.describe_key(
-                    KeyId=self.data.get('key')
+                    KeyId=key
                 ).get('KeyMetadata', {})
                 self.arns[r] = {
+                    # c7n:Key is the value provided in the policy filter data.
+                    # This may overlap with the key ID or ARN, but can also be
+                    # an alias.
+                    'c7n:Key': key,
+                    'KeyId': key_meta.get('KeyId'),
                     'Arn': key_meta.get('Arn'),
                     'KeyManager': key_meta.get('KeyManager'),
                     'Description': key_meta.get('Description')
@@ -3265,7 +3271,10 @@ class BucketEncryption(KMSKeyResolverMixin, Filter):
             return True
         elif crypto == 'aws:kms' and algo == 'aws:kms':
             if key:
-                if rule.get('KMSMasterKeyID') == key['Arn']:
+                # The default encryption rule can specify a key by alias,
+                # ID or full ARN. Match against any of those attributes.
+                key_ids = {key[k] for k in ('Arn', 'KeyId', 'c7n:Key')}
+                if rule.get('KMSMasterKeyID') in key_ids:
                     return True
                 else:
                     return False


Test patch:
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_1.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_1.json
index 3ba3ce33c..e4bdbfd7f 100644
--- a/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_1.json
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_1.json
@@ -1,19 +1,8 @@
 {
     "status_code": 200,
     "data": {
-        "ResponseMetadata": {
-            "RequestId": "3aa70f82-02af-11e9-8f13-8b7358831acf",
-            "HTTPStatusCode": 200,
-            "HTTPHeaders": {
-                "date": "Tue, 18 Dec 2018 10:25:23 GMT",
-                "content-type": "application/json",
-                "content-length": "295",
-                "connection": "keep-alive",
-                "x-amzn-requestid": "3aa70f82-02af-11e9-8f13-8b7358831acf"
-            },
-            "RetryAttempts": 0
-        },
-        "Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"Grant\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"lambda:GetLayerVersion\",\"Resource\":\"arn:aws:lambda:us-east-1:644160558196:layer:test:2\"}]}",
-        "RevisionId": "dc14c754-0f12-49cb-b263-95dd45f45bd3"
+        "ResponseMetadata": {},
+        "Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"xaccount2\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789123:root\"},\"Action\":\"lambda:GetLayerVersion\",\"Resource\":\"arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33:1\"}]}",
+        "RevisionId": "23d7f01d-6216-49c4-8eb4-c395afcfb47d"
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_2.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_2.json
index 495d8389c..cdad4e5c5 100644
--- a/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_2.json
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_2.json
@@ -2,21 +2,11 @@
     "status_code": 404,
     "data": {
         "Error": {
-            "Message": "Layer version arn:aws:lambda:us-east-1:644160558196:layer:test:2 does not have any resource policy.",
+            "Message": "No policy is associated with the given resource.",
             "Code": "ResourceNotFoundException"
         },
-        "ResponseMetadata": {
-            "RequestId": "3ac7de4a-02af-11e9-b949-5d121549c0c1",
-            "HTTPStatusCode": 404,
-            "HTTPHeaders": {
-                "date": "Tue, 18 Dec 2018 10:25:24 GMT",
-                "content-type": "application/json",
-                "content-length": "127",
-                "connection": "keep-alive",
-                "x-amzn-requestid": "3ac7de4a-02af-11e9-b949-5d121549c0c1",
-                "x-amzn-errortype": "ResourceNotFoundException"
-            },
-            "RetryAttempts": 0
-        }
+        "ResponseMetadata": {},
+        "Type": "User",
+        "Message": "No policy is associated with the given resource."
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_3.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_3.json
new file mode 100644
index 000000000..94bf314fb
--- /dev/null
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.GetLayerVersionPolicy_3.json
@@ -0,0 +1,12 @@
+{
+    "status_code": 404,
+    "data": {
+        "Error": {
+            "Message": "Layer version arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33:1 does not have any resource policy.",
+            "Code": "ResourceNotFoundException"
+        },
+        "ResponseMetadata": {},
+        "Type": "User",
+        "Message": "Layer version arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33:1 does not have any resource policy."
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_1.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_1.json
index 755e9a3df..ad52eccc1 100644
--- a/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_1.json
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_1.json
@@ -1,23 +1,19 @@
 {
     "status_code": 200,
     "data": {
-        "ResponseMetadata": {
-            "RequestId": "3a9a8bda-02af-11e9-846d-ff6320024c8c",
-            "HTTPStatusCode": 200,
-            "HTTPHeaders": {
-                "date": "Tue, 18 Dec 2018 10:25:23 GMT",
-                "content-type": "application/json",
-                "content-length": "231",
-                "connection": "keep-alive",
-                "x-amzn-requestid": "3a9a8bda-02af-11e9-846d-ff6320024c8c"
-            },
-            "RetryAttempts": 0
-        },
+        "ResponseMetadata": {},
         "LayerVersions": [
             {
-                "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:test:2",
-                "Version": 2,
-                "CreatedDate": "2018-12-18T10:20:13.948+0000"
+                "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33:1",
+                "Version": 1,
+                "Description": "Lambda Layer for c7n",
+                "CreatedDate": "2021-03-26T01:15:59.627+0000",
+                "CompatibleRuntimes": [
+                    "python2.7",
+                    "python3.6",
+                    "python3.7",
+                    "python3.8"
+                ]
             }
         ]
     }
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_2.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_2.json
new file mode 100644
index 000000000..6eff00791
--- /dev/null
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayerVersions_2.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "LayerVersions": [
+            {
+                "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-test:1",
+                "Version": 1,
+                "Description": "second test layer",
+                "CreatedDate": "2021-07-28T17:51:31.295+0000",
+                "CompatibleRuntimes": [
+                    "python3.8"
+                ]
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayers_1.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayers_1.json
index 34937a6b9..467e71873 100644
--- a/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayers_1.json
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.ListLayers_1.json
@@ -1,26 +1,35 @@
 {
     "status_code": 200,
     "data": {
-        "ResponseMetadata": {
-            "RequestId": "3a8a111d-02af-11e9-a945-e77482cd9b0c",
-            "HTTPStatusCode": 200,
-            "HTTPHeaders": {
-                "date": "Tue, 18 Dec 2018 10:25:23 GMT",
-                "content-type": "application/json",
-                "content-length": "331",
-                "connection": "keep-alive",
-                "x-amzn-requestid": "3a8a111d-02af-11e9-a945-e77482cd9b0c"
-            },
-            "RetryAttempts": 0
-        },
+        "ResponseMetadata": {},
         "Layers": [
             {
-                "LayerName": "test",
-                "LayerArn": "arn:aws:lambda:us-east-1:644160558196:layer:test",
+                "LayerName": "c7n-botocore1-20-33-boto31-17-33",
+                "LayerArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33",
+                "LatestMatchingVersion": {
+                    "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-botocore1-20-33-boto31-17-33:1",
+                    "Version": 1,
+                    "Description": "Lambda Layer for c7n",
+                    "CreatedDate": "2021-03-26T01:15:59.627+0000",
+                    "CompatibleRuntimes": [
+                        "python2.7",
+                        "python3.6",
+                        "python3.7",
+                        "python3.8"
+                    ]
+                }
+            },
+            {
+                "LayerName": "c7n-test",
+                "LayerArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-test",
                 "LatestMatchingVersion": {
-                    "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:test:2",
-                    "Version": 2,
-                    "CreatedDate": "2018-12-18T10:20:13.948+0000"
+                    "LayerVersionArn": "arn:aws:lambda:us-east-1:644160558196:layer:c7n-test:1",
+                    "Version": 1,
+                    "Description": "second test layer",
+                    "CreatedDate": "2021-07-28T17:51:31.295+0000",
+                    "CompatibleRuntimes": [
+                        "python3.8"
+                    ]
                 }
             }
         ]
diff --git a/tests/data/placebo/test_lambda_layer_cross_account/lambda.RemoveLayerVersionPermission_1.json b/tests/data/placebo/test_lambda_layer_cross_account/lambda.RemoveLayerVersionPermission_1.json
index 7360e0fd3..4636bf111 100644
--- a/tests/data/placebo/test_lambda_layer_cross_account/lambda.RemoveLayerVersionPermission_1.json
+++ b/tests/data/placebo/test_lambda_layer_cross_account/lambda.RemoveLayerVersionPermission_1.json
@@ -1,16 +1,6 @@
 {
     "status_code": 204,
     "data": {
-        "ResponseMetadata": {
-            "RequestId": "3ab519af-02af-11e9-b4a7-053d0d22210b",
-            "HTTPStatusCode": 204,
-            "HTTPHeaders": {
-                "date": "Tue, 18 Dec 2018 10:25:23 GMT",
-                "content-type": "application/json",
-                "connection": "keep-alive",
-                "x-amzn-requestid": "3ab519af-02af-11e9-b4a7-053d0d22210b"
-            },
-            "RetryAttempts": 0
-        }
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_1.json
index aa9a2182f..79d1a3dc6 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_1.json
@@ -1,36 +1,32 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
         "KeyMetadata": {
-            "Origin": "AWS_KMS", 
-            "KeyId": "079a6f7d-5f8a-4da1-a465-30aa099b9688", 
-            "Description": "Default master key that protects my S3 objects when no other key is defined", 
-            "KeyManager": "AWS", 
-            "Enabled": true, 
-            "KeyUsage": "ENCRYPT_DECRYPT", 
-            "KeyState": "Enabled", 
+            "AWSAccountId": "644160558196",
+            "KeyId": "7d48c7f6-0fa9-4b45-a65b-21d9e62af6db",
+            "Arn": "arn:aws:kms:us-east-1:644160558196:key/7d48c7f6-0fa9-4b45-a65b-21d9e62af6db",
             "CreationDate": {
-                "hour": 10, 
-                "__class__": "datetime", 
-                "month": 11, 
-                "second": 9, 
-                "microsecond": 25000, 
-                "year": 2017, 
-                "day": 21, 
-                "minute": 35
-            }, 
-            "Arn": "arn:aws:kms:us-east-1:108891588060:key/079a6f7d-5f8a-4da1-a465-30aa099b9688", 
-            "AWSAccountId": "108891588060"
-        }, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "b5f0a391-ced2-11e7-888f-9d643296b3e3", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "b5f0a391-ced2-11e7-888f-9d643296b3e3", 
-                "content-length": "405", 
-                "content-type": "application/x-amz-json-1.1"
-            }
-        }
+                "__class__": "datetime",
+                "year": 2018,
+                "month": 11,
+                "day": 27,
+                "hour": 13,
+                "minute": 16,
+                "second": 37,
+                "microsecond": 233000
+            },
+            "Enabled": true,
+            "Description": "Default master key that protects my S3 objects when no other key is defined",
+            "KeyUsage": "ENCRYPT_DECRYPT",
+            "KeyState": "Enabled",
+            "Origin": "AWS_KMS",
+            "KeyManager": "AWS",
+            "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
+            "EncryptionAlgorithms": [
+                "SYMMETRIC_DEFAULT"
+            ],
+            "MultiRegion": false
+        },
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_2.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_2.json
new file mode 100644
index 000000000..79d1a3dc6
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/kms.DescribeKey_2.json
@@ -0,0 +1,32 @@
+{
+    "status_code": 200,
+    "data": {
+        "KeyMetadata": {
+            "AWSAccountId": "644160558196",
+            "KeyId": "7d48c7f6-0fa9-4b45-a65b-21d9e62af6db",
+            "Arn": "arn:aws:kms:us-east-1:644160558196:key/7d48c7f6-0fa9-4b45-a65b-21d9e62af6db",
+            "CreationDate": {
+                "__class__": "datetime",
+                "year": 2018,
+                "month": 11,
+                "day": 27,
+                "hour": 13,
+                "minute": 16,
+                "second": 37,
+                "microsecond": 233000
+            },
+            "Enabled": true,
+            "Description": "Default master key that protects my S3 objects when no other key is defined",
+            "KeyUsage": "ENCRYPT_DECRYPT",
+            "KeyState": "Enabled",
+            "Origin": "AWS_KMS",
+            "KeyManager": "AWS",
+            "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
+            "EncryptionAlgorithms": [
+                "SYMMETRIC_DEFAULT"
+            ],
+            "MultiRegion": false
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_1.json
index 80cc2106a..60079c3ab 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_1.json
@@ -1,20 +1,7 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
-        "Location": "/c7n-bucket-with-encryption", 
-        "ResponseMetadata": {
-            "HTTPStatusCode": 200, 
-            "RetryAttempts": 0, 
-            "HostId": "a4vJMIYFSsO6sivB03rdj5gKG9QbLvvbeq+Jqxcgdhd5BB8Q3vGelndGvhp5c/TVrqMY4v5R98w=", 
-            "RequestId": "83B7A8F10B9C33A0", 
-            "HTTPHeaders": {
-                "content-length": "0", 
-                "x-amz-id-2": "a4vJMIYFSsO6sivB03rdj5gKG9QbLvvbeq+Jqxcgdhd5BB8Q3vGelndGvhp5c/TVrqMY4v5R98w=", 
-                "server": "AmazonS3", 
-                "x-amz-request-id": "83B7A8F10B9C33A0", 
-                "location": "/c7n-bucket-with-encryption", 
-                "date": "Tue, 21 Nov 2017 15:43:24 GMT"
-            }
-        }
+        "ResponseMetadata": {},
+        "Location": "/c7n-bucket-with-encryption-by-alias"
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_2.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_2.json
new file mode 100644
index 000000000..97b31cfcc
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_2.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Location": "/c7n-bucket-with-encryption-by-id"
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_3.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_3.json
new file mode 100644
index 000000000..084e72046
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.CreateBucket_3.json
@@ -0,0 +1,7 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "Location": "/c7n-bucket-with-encryption-by-arn"
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_1.json
index 0b296eb99..4636bf111 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_1.json
@@ -1,17 +1,6 @@
 {
-    "status_code": 204, 
+    "status_code": 204,
     "data": {
-        "ResponseMetadata": {
-            "HTTPStatusCode": 204, 
-            "RetryAttempts": 0, 
-            "HostId": "y2NCprjgfLQ+KgZoIqeADB3oB02F3gx5MECgTwq5D2yfCZYCUeEZpfsIG+xY1kEaPr8bzBXccE0=", 
-            "RequestId": "FE7B5142B22A2577", 
-            "HTTPHeaders": {
-                "x-amz-id-2": "y2NCprjgfLQ+KgZoIqeADB3oB02F3gx5MECgTwq5D2yfCZYCUeEZpfsIG+xY1kEaPr8bzBXccE0=", 
-                "date": "Tue, 21 Nov 2017 15:43:26 GMT", 
-                "x-amz-request-id": "FE7B5142B22A2577", 
-                "server": "AmazonS3"
-            }
-        }
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_2.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_2.json
new file mode 100644
index 000000000..4636bf111
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_2.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 204,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_3.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_3.json
new file mode 100644
index 000000000..4636bf111
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.DeleteBucket_3.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 204,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_1.json
index da243eb40..a5b02a183 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_1.json
@@ -1,28 +1,17 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
+        "ResponseMetadata": {},
         "ServerSideEncryptionConfiguration": {
             "Rules": [
                 {
                     "ApplyServerSideEncryptionByDefault": {
-                        "KMSMasterKeyID": "arn:aws:kms:us-east-1:108891588060:key/079a6f7d-5f8a-4da1-a465-30aa099b9688", 
-                        "SSEAlgorithm": "aws:kms"
-                    }
+                        "SSEAlgorithm": "aws:kms",
+                        "KMSMasterKeyID": "alias/aws/s3"
+                    },
+                    "BucketKeyEnabled": false
                 }
             ]
-        }, 
-        "ResponseMetadata": {
-            "HTTPStatusCode": 200, 
-            "RetryAttempts": 0, 
-            "HostId": "zqVTk3cUakkHvyP9ZGZ0mgsXqTUfInjSwe+EPWzd7M0vIszsQfDtq5rAHebvXtk9yLP96BdQ66I=", 
-            "RequestId": "09B675D916E0B25C", 
-            "HTTPHeaders": {
-                "x-amz-id-2": "zqVTk3cUakkHvyP9ZGZ0mgsXqTUfInjSwe+EPWzd7M0vIszsQfDtq5rAHebvXtk9yLP96BdQ66I=", 
-                "date": "Tue, 21 Nov 2017 15:43:25 GMT", 
-                "transfer-encoding": "chunked", 
-                "x-amz-request-id": "09B675D916E0B25C", 
-                "server": "AmazonS3"
-            }
         }
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_2.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_2.json
new file mode 100644
index 000000000..58471adc7
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_2.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "ServerSideEncryptionConfiguration": {
+            "Rules": [
+                {
+                    "ApplyServerSideEncryptionByDefault": {
+                        "SSEAlgorithm": "aws:kms",
+                        "KMSMasterKeyID": "arn:aws:kms:us-east-1:644160558196:key/7d48c7f6-0fa9-4b45-a65b-21d9e62af6db"
+                    },
+                    "BucketKeyEnabled": false
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_3.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_3.json
new file mode 100644
index 000000000..c1d88d9fd
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.GetBucketEncryption_3.json
@@ -0,0 +1,17 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {},
+        "ServerSideEncryptionConfiguration": {
+            "Rules": [
+                {
+                    "ApplyServerSideEncryptionByDefault": {
+                        "SSEAlgorithm": "aws:kms",
+                        "KMSMasterKeyID": "7d48c7f6-0fa9-4b45-a65b-21d9e62af6db"
+                    },
+                    "BucketKeyEnabled": false
+                }
+            ]
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.ListBuckets_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.ListBuckets_1.json
index 71b11f1bd..5541d7b70 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.ListBuckets_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.ListBuckets_1.json
@@ -1,38 +1,51 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
-        "Owner": {
-            "DisplayName": "voltio11", 
-            "ID": "284338e43c2e44ee905129e951168205bd004de76b005f19e33871d614d73c6b"
-        }, 
+        "ResponseMetadata": {},
         "Buckets": [
             {
+                "Name": "c7n-bucket-with-encryption-by-alias",
                 "CreationDate": {
-                    "hour": 15, 
-                    "__class__": "datetime", 
-                    "month": 11, 
-                    "second": 24, 
-                    "microsecond": 0, 
-                    "year": 2017, 
-                    "day": 21, 
-                    "minute": 43
-                }, 
-                "Name": "c7n-bucket-with-encryption"
-            }
-        ], 
-        "ResponseMetadata": {
-            "HTTPStatusCode": 200, 
-            "RetryAttempts": 0, 
-            "HostId": "P0hZ9952SAVp+bYquUPpU11vtGj8H8cyz39Htr6PTs4EfFSsk2HQz+xQsTPRfgT26z728z/w13g=", 
-            "RequestId": "3C258A453EAE751A", 
-            "HTTPHeaders": {
-                "x-amz-id-2": "P0hZ9952SAVp+bYquUPpU11vtGj8H8cyz39Htr6PTs4EfFSsk2HQz+xQsTPRfgT26z728z/w13g=", 
-                "server": "AmazonS3", 
-                "transfer-encoding": "chunked", 
-                "x-amz-request-id": "3C258A453EAE751A", 
-                "date": "Tue, 21 Nov 2017 15:43:25 GMT", 
-                "content-type": "application/xml"
+                    "__class__": "datetime",
+                    "year": 2021,
+                    "month": 7,
+                    "day": 30,
+                    "hour": 15,
+                    "minute": 27,
+                    "second": 9,
+                    "microsecond": 0
+                }
+            },
+            {
+                "Name": "c7n-bucket-with-encryption-by-arn",
+                "CreationDate": {
+                    "__class__": "datetime",
+                    "year": 2021,
+                    "month": 7,
+                    "day": 30,
+                    "hour": 15,
+                    "minute": 27,
+                    "second": 10,
+                    "microsecond": 0
+                }
+            },
+            {
+                "Name": "c7n-bucket-with-encryption-by-id",
+                "CreationDate": {
+                    "__class__": "datetime",
+                    "year": 2021,
+                    "month": 7,
+                    "day": 30,
+                    "hour": 15,
+                    "minute": 27,
+                    "second": 9,
+                    "microsecond": 0
+                }
             }
+        ],
+        "Owner": {
+            "DisplayName": "voltio11",
+            "ID": "284338e43c2e44ee905129e951168205bd004de76b005f19e33871d614d73c6b"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_1.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_1.json
index 0090ddae6..5b2170a07 100644
--- a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_1.json
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_1.json
@@ -1,18 +1,6 @@
 {
-    "status_code": 200, 
+    "status_code": 200,
     "data": {
-        "ResponseMetadata": {
-            "HTTPStatusCode": 200, 
-            "RetryAttempts": 0, 
-            "HostId": "FgcGoWiJ6jZymA37bNe09sku9gj9pKuFC2daSVY0nyDmsJLv1kb1T/r5G6a84hpBsy7GAJFdGM0=", 
-            "RequestId": "1516AF5C4DC9E03E", 
-            "HTTPHeaders": {
-                "x-amz-id-2": "FgcGoWiJ6jZymA37bNe09sku9gj9pKuFC2daSVY0nyDmsJLv1kb1T/r5G6a84hpBsy7GAJFdGM0=", 
-                "date": "Tue, 21 Nov 2017 15:43:24 GMT", 
-                "content-length": "0", 
-                "x-amz-request-id": "1516AF5C4DC9E03E", 
-                "server": "AmazonS3"
-            }
-        }
+        "ResponseMetadata": {}
     }
 }
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_2.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_2.json
new file mode 100644
index 000000000..5b2170a07
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_2.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_3.json b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_3.json
new file mode 100644
index 000000000..5b2170a07
--- /dev/null
+++ b/tests/data/placebo/test_s3_bucket_encryption_filter_kms/s3.PutBucketEncryption_3.json
@@ -0,0 +1,6 @@
+{
+    "status_code": 200,
+    "data": {
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_s3.py b/tests/test_s3.py
index 57e39102d..223c9614c 100644
--- a/tests/test_s3.py
+++ b/tests/test_s3.py
@@ -225,7 +225,19 @@ class BucketEncryption(BaseTest):
         self.assertEqual(resources[0]["Name"], bname)
 
     def test_s3_bucket_encryption_filter_kms(self):
-        bname = "c7n-bucket-with-encryption"
+        def _get_encryption_rule(key_id):
+            return {
+                "Rules": [
+                    {
+                        "ApplyServerSideEncryptionByDefault": {
+                            "SSEAlgorithm": "aws:kms",
+                            "KMSMasterKeyID": key_id
+                        }
+                    }
+                ]
+            }
+
+        bname_base = "c7n-bucket-with-encryption"
         self.patch(s3.S3, "executor_factory", MainThreadExecutor)
         self.patch(s3, "S3_AUGMENT_TABLE", [])
 
@@ -234,23 +246,26 @@ class BucketEncryption(BaseTest):
         )
 
         client = session_factory().client("s3")
-        client.create_bucket(Bucket=bname)
-        self.addCleanup(client.delete_bucket, Bucket=bname)
 
-        aws_alias = "arn:aws:kms:us-east-1:108891588060:key/079a6f7d-5f8a-4da1-a465-30aa099b9688"
-        enc = {
-            "Rules": [
-                {
-                    "ApplyServerSideEncryptionByDefault": {
-                        "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": aws_alias
-                    }
-                }
-            ]
+        key_alias = "alias/aws/s3"
+        key_meta = session_factory().client("kms").describe_key(KeyId=key_alias)["KeyMetadata"]
+
+        key_attrs = {
+            'alias': key_alias,
+            'id': key_meta.get('KeyId'),
+            'arn': key_meta.get('Arn')
         }
 
-        client.put_bucket_encryption(
-            Bucket=bname, ServerSideEncryptionConfiguration=enc
-        )
+        for attr, value in key_attrs.items():
+            # Create 3 test buckets. Set a default encryption rule for each
+            # one, using different attributes of the same key.
+            bname = f'{bname_base}-by-{attr}'
+            client.create_bucket(Bucket=bname)
+            client.put_bucket_encryption(
+                Bucket=bname,
+                ServerSideEncryptionConfiguration=_get_encryption_rule(value)
+            )
+            self.addCleanup(client.delete_bucket, Bucket=bname)
 
         p = self.load_policy(
             {
@@ -260,15 +275,15 @@ class BucketEncryption(BaseTest):
                     {
                         "type": "bucket-encryption",
                         "crypto": "aws:kms",
-                        "key": "alias/aws/s3",
+                        "key": key_alias,
                     }
                 ],
             },
             session_factory=session_factory,
         )
         resources = p.run() or []
-        self.assertEqual(len(resources), 1)
-        self.assertEqual(resources[0]["Name"], bname)
+        self.assertEqual(len(resources), 3)
+        self.assertTrue(all(r["Name"].startswith(bname_base) for r in resources))
 
     def test_s3_filter_bucket_encryption_disabled(self):
         bname = "c7n-bucket-without-default-encryption"