Skip to content

Commit 29b0d66

Browse files
mergify[bot]mergify[bot]
authored
chore(release): v2.143.1 (#30377)
See [CHANGELOG](https://github.com/aws/aws-cdk/pull/30377/files#diff-9e3d5c5da890b65a67bf632f93416744d5b76f6eb239e42ab714c7768429ff99)
2 parents 9f2bdf7 + eb451cb commit 29b0d66

File tree

11 files changed

+46
-147
lines changed

11 files changed

+46
-147
lines changed

‎CHANGELOG.v2.alpha.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.143.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.143.0-alpha.0...v2.143.1-alpha.0) (2024-05-30)
6+
57
## [2.143.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.142.1-alpha.0...v2.143.0-alpha.0) (2024-05-23)
68

79
## [2.142.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.142.0-alpha.0...v2.142.1-alpha.0) (2024-05-17)

‎CHANGELOG.v2.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
44

5+
## [2.143.1](https://github.com/aws/aws-cdk/compare/v2.143.0...v2.143.1) (2024-05-30)
6+
7+
8+
### Reverts
9+
10+
* fix(ses-actions): permissions too wide for S3 action ([#30375](https://github.com/aws/aws-cdk/issues/30375)) ([6c716c6](https://github.com/aws/aws-cdk/commit/6c716c68ec2a222a1262577942ffde42002d2f44))
11+
512
## [2.143.0](https://github.com/aws/aws-cdk/compare/v2.142.1...v2.143.0) (2024-05-23)
613

714

‎packages/@aws-cdk-testing/framework-integ/test/aws-ses-actions/test/integ.actions.js.snapshot/aws-cdk-ses-receipt.assets.json

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ses-actions/test/integ.actions.js.snapshot/aws-cdk-ses-receipt.template.json

Lines changed: 2 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -86,35 +86,8 @@
8686
"Action": "s3:PutObject",
8787
"Condition": {
8888
"StringEquals": {
89-
"aws:SourceAccount": {
89+
"aws:Referer": {
9090
"Ref": "AWS::AccountId"
91-
},
92-
"aws:SourceArn": {
93-
"Fn::Join": [
94-
"",
95-
[
96-
"arn:",
97-
{
98-
"Ref": "AWS::Partition"
99-
},
100-
":ses:",
101-
{
102-
"Ref": "AWS::Region"
103-
},
104-
":",
105-
{
106-
"Ref": "AWS::AccountId"
107-
},
108-
":receipt-rule-set/",
109-
{
110-
"Ref": "RuleSetE30C6C48"
111-
},
112-
":receipt-rule/",
113-
{
114-
"Ref": "RuleSetFirstRule0A27C8CC"
115-
}
116-
]
117-
]
11891
}
11992
}
12093
},
@@ -313,6 +286,7 @@
313286
}
314287
},
315288
"DependsOn": [
289+
"BucketPolicyE9A3008A",
316290
"FunctionAllowSes1829904A"
317291
]
318292
},

‎packages/@aws-cdk-testing/framework-integ/test/aws-ses-actions/test/integ.actions.js.snapshot/manifest.json

Lines changed: 3 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ses-actions/test/integ.actions.js.snapshot/tree.json

Lines changed: 1 addition & 28 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/aws-cdk-lib/aws-ses-actions/lib/s3.ts

Lines changed: 22 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,32 @@ export interface S3Props {
4242
* a notification to Amazon SNS.
4343
*/
4444
export class S3 implements ses.IReceiptRuleAction {
45-
private rule?: ses.IReceiptRule;
45+
4646
constructor(private readonly props: S3Props) {
4747
}
4848

4949
public bind(rule: ses.IReceiptRule): ses.ReceiptRuleActionConfig {
50-
this.rule = rule;
50+
// Allow SES to write to S3 bucket
51+
// See https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-permissions.html#receiving-email-permissions-s3
52+
const keyPattern = this.props.objectKeyPrefix || '';
53+
const s3Statement = new iam.PolicyStatement({
54+
actions: ['s3:PutObject'],
55+
principals: [new iam.ServicePrincipal('ses.amazonaws.com')],
56+
resources: [this.props.bucket.arnForObjects(`${keyPattern}*`)],
57+
conditions: {
58+
StringEquals: {
59+
'aws:Referer': cdk.Aws.ACCOUNT_ID,
60+
},
61+
},
62+
});
63+
this.props.bucket.addToResourcePolicy(s3Statement);
64+
65+
const policy = this.props.bucket.node.tryFindChild('Policy') as s3.BucketPolicy;
66+
if (policy) { // The bucket could be imported
67+
rule.node.addDependency(policy);
68+
} else {
69+
cdk.Annotations.of(rule).addWarningV2('@aws-cdk/s3:AddBucketPermissions', 'This rule is using a S3 action with an imported bucket. Ensure permission is given to SES to write to that bucket.');
70+
}
5171

5272
// Allow SES to use KMS master key
5373
// See https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-permissions.html#receiving-email-permissions-kms
@@ -79,41 +99,4 @@ export class S3 implements ses.IReceiptRuleAction {
7999
},
80100
};
81101
}
82-
83-
/**
84-
* Generate and apply the receipt rule action statement
85-
*
86-
* @param ruleSet The rule set the rule is being added to
87-
* @internal
88-
*/
89-
public _applyPolicyStatement(receiptRuleSet: ses.IReceiptRuleSet): void {
90-
if (!this.rule) {
91-
throw new Error('Cannot apply policy statement before binding the action to a receipt rule');
92-
}
93-
94-
// Allow SES to write to S3 bucket
95-
// See https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-permissions.html#receiving-email-permissions-s3
96-
const keyPattern = this.props.objectKeyPrefix || '';
97-
const s3Statement = new iam.PolicyStatement({
98-
actions: ['s3:PutObject'],
99-
principals: [new iam.ServicePrincipal('ses.amazonaws.com')],
100-
resources: [this.props.bucket.arnForObjects(`${keyPattern}*`)],
101-
conditions: {
102-
StringEquals: {
103-
'aws:SourceAccount': cdk.Aws.ACCOUNT_ID,
104-
'aws:SourceArn': cdk.Arn.format({
105-
partition: cdk.Aws.PARTITION,
106-
service: 'ses',
107-
region: cdk.Aws.REGION,
108-
account: cdk.Aws.ACCOUNT_ID,
109-
resource: [
110-
`receipt-rule-set/${receiptRuleSet.receiptRuleSetName}`,
111-
`receipt-rule/${this.rule.receiptRuleName}`,
112-
].join(':'),
113-
}),
114-
},
115-
},
116-
});
117-
this.props.bucket.addToResourcePolicy(s3Statement);
118-
}
119102
}

‎packages/aws-cdk-lib/aws-ses-actions/test/actions.test.ts

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -190,26 +190,9 @@ test('add s3 action', () => {
190190
Action: 's3:PutObject',
191191
Condition: {
192192
StringEquals: {
193-
'aws:SourceAccount': {
193+
'aws:Referer': {
194194
Ref: 'AWS::AccountId',
195195
},
196-
'aws:SourceArn': {
197-
'Fn::Join': [
198-
'',
199-
[
200-
'arn:',
201-
{ Ref: 'AWS::Partition' },
202-
':ses:',
203-
{ Ref: 'AWS::Region' },
204-
':',
205-
{ Ref: 'AWS::AccountId' },
206-
':receipt-rule-set/',
207-
{ Ref: 'RuleSetE30C6C48' },
208-
':receipt-rule/',
209-
{ Ref: 'RuleSetRule0B1D6BCA' },
210-
],
211-
],
212-
},
213196
},
214197
},
215198
Effect: 'Allow',

‎packages/aws-cdk-lib/aws-ses/lib/receipt-rule-action.ts

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import { IReceiptRule } from './receipt-rule';
2-
import { IReceiptRuleSet } from './receipt-rule-set';
32

43
/**
54
* An abstract action for a receipt rule.
@@ -10,13 +9,6 @@ export interface IReceiptRuleAction {
109
*/
1110
bind(receiptRule: IReceiptRule): ReceiptRuleActionConfig;
1211

13-
/**
14-
* Generate and apply the receipt rule action statement
15-
*
16-
* @param ruleSet The rule set the rule is being added to
17-
* @internal
18-
*/
19-
_applyPolicyStatement?(ruleSet: IReceiptRuleSet): void;
2012
}
2113

2214
/**

‎packages/aws-cdk-lib/aws-ses/lib/receipt-rule.ts

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,7 @@ export class ReceiptRule extends Resource implements IReceiptRule {
112112
}
113113

114114
public readonly receiptRuleName: string;
115-
116-
private readonly ruleSet: IReceiptRuleSet;
117-
private readonly actions: IReceiptRuleAction[] = [];
118-
private readonly actionProperties: CfnReceiptRule.ActionProperty[] = [];
115+
private readonly actions = new Array<CfnReceiptRule.ActionProperty>();
119116

120117
constructor(scope: Construct, id: string, props: ReceiptRuleProps) {
121118
super(scope, id, {
@@ -136,7 +133,6 @@ export class ReceiptRule extends Resource implements IReceiptRule {
136133
});
137134

138135
this.receiptRuleName = resource.ref;
139-
this.ruleSet = props.ruleSet;
140136

141137
for (const action of props.actions || []) {
142138
this.addAction(action);
@@ -147,20 +143,15 @@ export class ReceiptRule extends Resource implements IReceiptRule {
147143
* Adds an action to this receipt rule.
148144
*/
149145
public addAction(action: IReceiptRuleAction) {
150-
this.actions.push(action);
151-
this.actionProperties.push(action.bind(this));
146+
this.actions.push(action.bind(this));
152147
}
153148

154149
private renderActions() {
155-
if (this.actionProperties.length === 0) {
150+
if (this.actions.length === 0) {
156151
return undefined;
157152
}
158153

159-
for (const action of this.actions) {
160-
action._applyPolicyStatement?.(this.ruleSet);
161-
}
162-
163-
return this.actionProperties;
154+
return this.actions;
164155
}
165156
}
166157

‎version.v2.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
{
2-
"version": "2.143.0",
3-
"alphaVersion": "2.143.0-alpha.0"
2+
"version": "2.143.1",
3+
"alphaVersion": "2.143.1-alpha.0"
44
}

0 commit comments

Comments
 (0)