From 966bfd03e7a44979caa136cb122275fc75b3c3ba Mon Sep 17 00:00:00 2001
From: Jack Wells <jack.wells@invoice2go.com>
Date: Thu, 7 May 2020 10:16:00 -0700
Subject: [PATCH 1/2] Added S3 SSEKMSKeyId config option

---
 dvc/config.py    | 1 +
 dvc/remote/s3.py | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/dvc/config.py b/dvc/config.py
index ff968a682f..d8c80ba5da 100644
--- a/dvc/config.py
+++ b/dvc/config.py
@@ -151,6 +151,7 @@ class RelPath(str):
                     Optional("listobjects", default=False): Bool,
                     Optional("use_ssl", default=True): Bool,
                     "sse": str,
+                    "sse_kms_key_id": str,
                     "acl": str,
                     "grant_read": str,
                     "grant_read_acp": str,
diff --git a/dvc/remote/s3.py b/dvc/remote/s3.py
index 0ebb4099fd..8d92642e9d 100644
--- a/dvc/remote/s3.py
+++ b/dvc/remote/s3.py
@@ -46,6 +46,10 @@ def __init__(self, repo, config):
         if self.sse:
             self.extra_args["ServerSideEncryption"] = self.sse
 
+        self.sse_kms_key_id = config.get("sse_kms_key_id")
+        if self.sse_kms_key_id:
+            self.extra_args["SSEKMSKeyId"] = self.sse_kms_key_id
+
         self.acl = config.get("acl")
         if self.acl:
             self.extra_args["ACL"] = self.acl

From d50a45f6ca7fd999e79d10e2a6a02eaa5f6318ab Mon Sep 17 00:00:00 2001
From: Ruslan Kuprieiev <ruslan@iterative.ai>
Date: Mon, 11 May 2020 22:14:21 +0300
Subject: [PATCH 2/2] test: unit: s3: add SSEKMSKeyId test

---
 tests/unit/remote/test_s3.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/unit/remote/test_s3.py b/tests/unit/remote/test_s3.py
index c32091e0a8..b9ee1ebd37 100644
--- a/tests/unit/remote/test_s3.py
+++ b/tests/unit/remote/test_s3.py
@@ -53,3 +53,8 @@ def test_grants_mutually_exclusive_acl_error(dvc, grants):
 
         with pytest.raises(ConfigError):
             S3Remote(dvc, config)
+
+
+def test_sse_kms_key_id(dvc):
+    remote = S3Remote(dvc, {"url": url, "sse_kms_key_id": "key"})
+    assert remote.extra_args["SSEKMSKeyId"] == "key"