AWS ORG policy to enforce CMK key

Question

I would like to create a SCP policy on all the accounts in my AWS org that enfoces the use of customer managed key for the encryptions of new buckets

i found that this should have worked

   {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3BucketCreationWithoutKMSEncryption",
      "Effect": "Deny",
      "Action": [
        "s3:CreateBucket"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "s3:x-amz-server-side-encryption": [
            "AES256"
          ]
        }
      }
    }
  ]
}

I also treid many other vreation of it and they all not working can any one advise?