Open markusl opened 4 months ago
Yes, it's missing the required conditions in the bucket policy.
// create a DummyStack
export class DummyStack extends Stack {
constructor(scope: Construct, id: string, props: StackProps) {
super(scope, id, props);
const ruleSet = new ses.ReceiptRuleSet(this, 'RuleSet');
const defaultRule = ruleSet.addRule('DefaultRule', {
recipients: ['foo.com'],
enabled: true,
});
defaultRule.addAction(new sesa.S3({
bucket: new s3.Bucket(this, 'EmailBucket', {
removalPolicy: RemovalPolicy.DESTROY,
bucketName: 'mock-bucket-name',
}),
}));
}
}
BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket:
Ref: EmailBucket843A740F
PolicyDocument:
Statement:
- Action: s3:PutObject
Condition:
StringEquals:
aws:Referer:
Ref: AWS::AccountId
Effect: Allow
Principal:
Service: ses.amazonaws.com
Resource:
Fn::Join:
- ""
- - Fn::GetAtt:
- EmailBucket843A740F
- Arn
- /*
Version: "2012-10-17"
Guess we should fix here
Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.
Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.
Since the PR for this issue is reverted, I am re-opening this issue, although I am not sure if there is a good way to fix without running into the same problem that caused the revert..
Describe the bug
SES ReceiptRuleSet S3 action grants too wide permissions
Expected Behavior
Should work as documented https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html#receiving-email-permissions-s3
Currently missing the following block:
Current Behavior
https://github.com/aws/aws-cdk/blob/a7384c282756890a3e211c064b4e8a2dee3dab2a/packages/aws-cdk-lib/aws-ses-actions/test/actions.test.ts#L186
Reproduction Steps
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.137.0
Framework Version
No response
Node.js Version
20
OS
all
Language
TypeScript
Language Version
No response
Other information
No response