[kartik2112]

When a target S3 bucket enforces SSE-KMS, _validate_s3_path_exists previously failed with access denied because its put_object call to create a missing prefix did not specify encryption. Thread the SFTTrainer kms_key_id (already available in _create_output_config) into _validate_s3_path_exists and include ServerSideEncryption=aws:kms and SSEKMSKeyId when it is provided.

Fixes #5930

Issue #, if available:

Description of changes:
Adds SSEKMS Key support to SFT Trainer for validate_s3_path step and create missing prefixes

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[kartik2112]

@lucasjia-aws @zhaoqizqwang could you review if this is a helpful change. Based on my experimentation, this fixes the ServerSideEncryption protected buckets access issue during _validate_s3_path_exists step

[kartik2112]

Thanks for the approval @mufaddal-rohawala. PR should be ready to merge

[mohamedzeidan2021]

Can you fix the codestyle failures ? the rest of the failures seem to be due to flakiness

[kartik2112]

Can you fix the codestyle failures ? the rest of the failures seem to be due to flakiness

Should be fixed now

[github-actions]

🤖 AI code review

This PR threads the SFTTrainer kms_key_id through _create_output_config into _validate_s3_path_exists, so the put_object call that creates a missing prefix includes ServerSideEncryption=aws:kms and SSEKMSKeyId when a KMS key is provided. This fixes access-denied failures on buckets enforcing SSE-KMS (issue #5930). The change is minimal, correct, follows the existing encryption patterns in the file, and includes a new unit test plus an updated assertion. Optional is already imported. No issues found.

_{Reviewed commit 5c77980. Automated review; verify before acting.}