AWS SCP for mandating S3 bucket encryption

Question

I am trying to get a scp policy which would mandate s3 bucket encryption. Below given is the policy but this is providing me access denied error while trying to create bucket.

{
"Sid": "DenyNoEncryption",
"Effect": "Deny",
"Principal": {
"Action": "s3:CreateBucket",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption-kms-id": "kms-id"
}
}
}