Query: kms_keys_for_s3_bucket

select
  k.arn as key_arn
from
  aws_s3_bucket as b
  cross join jsonb_array_elements(server_side_encryption_configuration -> 'Rules') as r
  join aws_kms_key as k
  on k.arn = r -> 'ApplyServerSideEncryptionByDefault' ->> 'KMSMasterKeyID'
where
  b.arn = $1;