feat(s3): model BlockedEncryptionTypes on bucket default encryption

ServerSideEncryptionRule now exposes BlockedEncryptionTypes (an
EncryptionType listing of NONE/SSE-C), matching the property the Cloud
Control runtime already reads. Without it, a bucket that blocks SSE-C
could not be declared: extract omitted the field and reconcile planned
to strip it, so bring-under-management was not side-effect free.

Adds a dedicated conformance fixture (and update variant flipping SSE-C
to NONE) exercising the round-trip.

Author: JeroenSoeters

CHANGELOG.md

@@ -8,6 +8,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Install with `sudo formae plugin install aws` on the host that runs the
 formae agent.
 
+## [Unreleased]
+
+### Added
+
+- S3 `BucketEncryption`: `ServerSideEncryptionRule` now models
+  `BlockedEncryptionTypes` (an `EncryptionType` listing of `NONE`/`SSE-C`), so
+  buckets that block SSE-C round-trip through extract and reconcile instead of
+  having the setting stripped on bring-under-management.
+
 ## [0.1.16]
 
 ### Changed

schema/pkl/s3/bucket.pkl

@@ -42,6 +42,13 @@ open class AnalyticsConfiguration extends formae.SubResource {
     tagFilters: Listing<aws.Tag>?
 }
 
+typealias EncryptionType = "NONE"|"SSE-C"
+
+@aws.SubResourceHint
+open class BlockedEncryptionTypes extends formae.SubResource {
+    encryptionType: Listing<EncryptionType>?
+}
+
 @aws.SubResourceHint
 open class BucketEncryption extends formae.SubResource {
     serverSideEncryptionConfiguration: Listing<ServerSideEncryptionRule>
@@ -477,6 +484,8 @@ open class ServerSideEncryptionByDefault extends formae.SubResource {
 
 @aws.SubResourceHint
 open class ServerSideEncryptionRule extends formae.SubResource {
+    blockedEncryptionTypes: BlockedEncryptionTypes?
+
     bucketKeyEnabled: Boolean?
 
     serverSideEncryptionByDefault: ServerSideEncryptionByDefault?

testdata/s3-bucket-encryption-update.pkl

@@ -0,0 +1,51 @@
+/*
+ * © 2025 Platform Engineering Labs Inc.
+ *
+ * SPDX-License-Identifier: FSL-1.1-ALv2
+ */
+
+amends "@formae/forma.pkl"
+import "@formae/formae.pkl"
+
+import "@aws/aws.pkl"
+
+import "@aws/s3/bucket.pkl"
+
+// Read the test run ID from environment variable set by the test harness
+// This ensures consistent naming within a test run but unique names between runs
+local testRunID = read("env:FORMAE_TEST_RUN_ID")
+local stackName = "plugin-sdk-test-s3-bucket-encryption-\(testRunID)"
+
+forma {
+  new formae.Stack {
+    label = stackName
+    description = "Plugin SDK test for S3 Bucket default encryption with BlockedEncryptionTypes"
+  }
+
+  new formae.Target {
+    label = "aws-target"
+    config = new aws.Config {
+      region = "us-east-1"
+    }
+  }
+
+  new bucket.Bucket {
+    label = "plugin-sdk-test-bucket-encryption"
+    bucketName = "formae-plugin-sdk-test-encryption-\(testRunID)"
+    bucketEncryption = new bucket.BucketEncryption {
+      serverSideEncryptionConfiguration {
+        new bucket.ServerSideEncryptionRule {
+          bucketKeyEnabled = true
+          serverSideEncryptionByDefault = new bucket.ServerSideEncryptionByDefault {
+            sseAlgorithm = "AES256"
+          }
+          blockedEncryptionTypes = new bucket.BlockedEncryptionTypes {
+            encryptionType {
+              "NONE"
+            }
+          }
+        }
+      }
+    }
+  }
+}

testdata/s3-bucket-encryption.pkl

@@ -0,0 +1,51 @@
+/*
+ * © 2025 Platform Engineering Labs Inc.
+ *
+ * SPDX-License-Identifier: FSL-1.1-ALv2
+ */
+
+amends "@formae/forma.pkl"
+import "@formae/formae.pkl"
+
+import "@aws/aws.pkl"
+
+import "@aws/s3/bucket.pkl"
+
+// Read the test run ID from environment variable set by the test harness
+// This ensures consistent naming within a test run but unique names between runs
+local testRunID = read("env:FORMAE_TEST_RUN_ID")
+local stackName = "plugin-sdk-test-s3-bucket-encryption-\(testRunID)"
+
+forma {
+  new formae.Stack {
+    label = stackName
+    description = "Plugin SDK test for S3 Bucket default encryption with BlockedEncryptionTypes"
+  }
+
+  new formae.Target {
+    label = "aws-target"
+    config = new aws.Config {
+      region = "us-east-1"
+    }
+  }
+
+  new bucket.Bucket {
+    label = "plugin-sdk-test-bucket-encryption"
+    bucketName = "formae-plugin-sdk-test-encryption-\(testRunID)"
+    bucketEncryption = new bucket.BucketEncryption {
+      serverSideEncryptionConfiguration {
+        new bucket.ServerSideEncryptionRule {
+          bucketKeyEnabled = true
+          serverSideEncryptionByDefault = new bucket.ServerSideEncryptionByDefault {
+            sseAlgorithm = "AES256"
+          }
+          blockedEncryptionTypes = new bucket.BlockedEncryptionTypes {
+            encryptionType {
+              "SSE-C"
+            }
+          }
+        }
+      }
+    }
+  }
+}