What they won't tell you is that this will use the default KMS key, which cannot be shared across accounts. So your S3 bucket objects cannot be shared across AWS accounts by default, unless you setup a custom KMS key and "copy" everything in place (a standard AWS organisation is made of multiple accounts).