Enforce Encryption on SNS creation by SCP

I would like to create an SCP to enforce encryption on SNS creation. I am creating the below policy but it failed.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Deny", "Action": [ "sns:CreateTopic" ], "Resource": "*", "Condition": { "StringNotEquals": { "KmsMasterKeyId": "alias/aws/sns" } } } ] }