Disallowing unencrypted PUTs to S3 - post

Question

I have a working direct browser upload form to upload files from the browser to S3 directly, including enabling server side encryption for each upload via the upload policy and form fields for x-amz-server-side-encryption.
The problem is with the bucket policy on the S3 side to enforce server side encryption on uploaded files. With no bucket policy in place, my files are uploaded perfectly, with server side encryption enabled. When I add the bucket policy, uploads are rejected with an HTTP 403 (AccessDenied) error.
Here is the complete bucket policy I am using (lifted from the Amazon documentation):
{
"Version": "2008-10-17",
"Id": "PutObjPolicy",
"Statement": [
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::MY-BUCKET-NAME/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "AES256"
}
}
}
]
}
Here is an example of the policy (unencoded and formatted) that is signed and used in the upload form:
{
"expiration": "2013-04-14T14:29:56.000Z",
"conditions": [
{
"bucket": "MY-BUCKET-NAME"
},
{
"acl": "private"
},
{
"x-amz-server-side-encryption": "AES256"
},
[
"starts-with", "$key", "uploads/"
],
{
"success_action_status": "201"
}
]
}
I'll omit the upload form details for brevity, but suffice to say, it sets the corresponding hidden form field for x-amz-server-side-encryption. Again, this works without the bucket policy in place, so I believe the client-side aspects of this are in good shape. My guess is at this point that maybe I should be specifically allowing a certain class of PUTs, but I'm not sure what to add.
Any ideas?