Here’s the CLI command to set server-side AES-256 encryption on a bucket.
$ aws s3api put-bucket-encryption --bucket bucket-name \ --server-side-encryption-configuration \ '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}' |
You can apply this to any existing bucket.