diff --git a/state/remote/s3.go b/state/remote/s3.go
index 26330d112..dcf9a3b80 100644
--- a/state/remote/s3.go
+++ b/state/remote/s3.go
@@ -50,6 +50,7 @@ func s3Factory(conf map[string]string) (Client, error) {
 	if raw, ok := conf["acl"]; ok {
 		acl = raw
 	}
+	kmsKeyID := conf["kmsKeyID"]
 
 	accessKeyId := conf["access_key"]
 	secretAccessKey := conf["secret_key"]
@@ -84,6 +85,7 @@ func s3Factory(conf map[string]string) (Client, error) {
 		keyName:              keyName,
 		serverSideEncryption: serverSideEncryption,
 		acl:                  acl,
+		kmsKeyID:             kmsKeyID,
 	}, nil
 }
 
@@ -93,6 +95,7 @@ type S3Client struct {
 	keyName              string
 	serverSideEncryption bool
 	acl                  string
+	kmsKeyID             string
 }
 
 func (c *S3Client) Get() (*Payload, error) {
@@ -145,7 +148,12 @@ func (c *S3Client) Put(data []byte) error {
 	}
 
 	if c.serverSideEncryption {
-		i.ServerSideEncryption = aws.String("AES256")
+		if c.kmsKeyID != "" {
+			i.SSEKMSKeyID = &c.kmsKeyID
+			i.ServerSideEncryption = aws.String("aws:kms")
+		} else {
+			i.ServerSideEncryption = aws.String("AES256")
+		}
 	}
 
 	if c.acl != "" {