Comment by parzivalm

If you took ten seconds to look at the posted source note above, you would see Cloud Custodian has a policy to enforce bucket encryption.