Skip to content

Commit aafc6eb

Browse files
author
awstools
committed
feat(client-ses): Enable email receiving customers to provide SES with access to their S3 buckets via an IAM role for "Deliver to S3 Action"
1 parent d038be3 commit aafc6eb

File tree

9 files changed

+73
-13
lines changed

9 files changed

+73
-13
lines changed

‎clients/client-ses/src/commands/CreateReceiptRuleCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ export interface CreateReceiptRuleCommandOutput extends CreateReceiptRuleRespons
5555
* BucketName: "STRING_VALUE", // required
5656
* ObjectKeyPrefix: "STRING_VALUE",
5757
* KmsKeyArn: "STRING_VALUE",
58+
* IamRoleArn: "STRING_VALUE",
5859
* },
5960
* BounceAction: { // BounceAction
6061
* TopicArn: "STRING_VALUE",

‎clients/client-ses/src/commands/DescribeActiveReceiptRuleSetCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ export interface DescribeActiveReceiptRuleSetCommandOutput
6363
* // BucketName: "STRING_VALUE", // required
6464
* // ObjectKeyPrefix: "STRING_VALUE",
6565
* // KmsKeyArn: "STRING_VALUE",
66+
* // IamRoleArn: "STRING_VALUE",
6667
* // },
6768
* // BounceAction: { // BounceAction
6869
* // TopicArn: "STRING_VALUE",

‎clients/client-ses/src/commands/DescribeReceiptRuleCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ export interface DescribeReceiptRuleCommandOutput extends DescribeReceiptRuleRes
5959
* // BucketName: "STRING_VALUE", // required
6060
* // ObjectKeyPrefix: "STRING_VALUE",
6161
* // KmsKeyArn: "STRING_VALUE",
62+
* // IamRoleArn: "STRING_VALUE",
6263
* // },
6364
* // BounceAction: { // BounceAction
6465
* // TopicArn: "STRING_VALUE",

‎clients/client-ses/src/commands/DescribeReceiptRuleSetCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ export interface DescribeReceiptRuleSetCommandOutput extends DescribeReceiptRule
6363
* // BucketName: "STRING_VALUE", // required
6464
* // ObjectKeyPrefix: "STRING_VALUE",
6565
* // KmsKeyArn: "STRING_VALUE",
66+
* // IamRoleArn: "STRING_VALUE",
6667
* // },
6768
* // BounceAction: { // BounceAction
6869
* // TopicArn: "STRING_VALUE",

‎clients/client-ses/src/commands/SendBulkTemplatedEmailCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ export interface SendBulkTemplatedEmailCommandOutput extends SendBulkTemplatedEm
9494
* ],
9595
* Template: "STRING_VALUE", // required
9696
* TemplateArn: "STRING_VALUE",
97-
* DefaultTemplateData: "STRING_VALUE",
97+
* DefaultTemplateData: "STRING_VALUE", // required
9898
* Destinations: [ // BulkEmailDestinationList // required
9999
* { // BulkEmailDestination
100100
* Destination: { // Destination

‎clients/client-ses/src/commands/UpdateReceiptRuleCommand.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ export interface UpdateReceiptRuleCommandOutput extends UpdateReceiptRuleRespons
5454
* BucketName: "STRING_VALUE", // required
5555
* ObjectKeyPrefix: "STRING_VALUE",
5656
* KmsKeyArn: "STRING_VALUE",
57+
* IamRoleArn: "STRING_VALUE",
5758
* },
5859
* BounceAction: { // BounceAction
5960
* TopicArn: "STRING_VALUE",

‎clients/client-ses/src/models/models_0.ts

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1721,29 +1721,29 @@ export interface S3Action {
17211721
ObjectKeyPrefix?: string;
17221722

17231723
/**
1724-
* <p>The customer master key that Amazon SES should use to encrypt your emails before saving
1725-
* them to the Amazon S3 bucket. You can use the default master key or a custom master key that
1724+
* <p>The customer managed key that Amazon SES should use to encrypt your emails before saving
1725+
* them to the Amazon S3 bucket. You can use the default managed key or a custom managed key that
17261726
* you created in Amazon Web Services KMS as follows:</p>
17271727
* <ul>
17281728
* <li>
1729-
* <p>To use the default master key, provide an ARN in the form of
1729+
* <p>To use the default managed key, provide an ARN in the form of
17301730
* <code>arn:aws:kms:REGION:ACCOUNT-ID-WITHOUT-HYPHENS:alias/aws/ses</code>.
17311731
* For example, if your Amazon Web Services account ID is 123456789012 and you want to use the
1732-
* default master key in the US West (Oregon) Region, the ARN of the default master
1732+
* default managed key in the US West (Oregon) Region, the ARN of the default master
17331733
* key would be <code>arn:aws:kms:us-west-2:123456789012:alias/aws/ses</code>. If
1734-
* you use the default master key, you don't need to perform any extra steps to
1734+
* you use the default managed key, you don't need to perform any extra steps to
17351735
* give Amazon SES permission to use the key.</p>
17361736
* </li>
17371737
* <li>
1738-
* <p>To use a custom master key that you created in Amazon Web Services KMS, provide the ARN of
1739-
* the master key and ensure that you add a statement to your key's policy to give
1738+
* <p>To use a custom managed key that you created in Amazon Web Services KMS, provide the ARN of
1739+
* the managed key and ensure that you add a statement to your key's policy to give
17401740
* Amazon SES permission to use it. For more information about giving permissions, see
17411741
* the <a href="https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html">Amazon SES Developer
17421742
* Guide</a>.</p>
17431743
* </li>
17441744
* </ul>
17451745
* <p>For more information about key policies, see the <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html">Amazon Web Services KMS Developer Guide</a>. If
1746-
* you do not specify a master key, Amazon SES does not encrypt your emails.</p>
1746+
* you do not specify a managed key, Amazon SES does not encrypt your emails.</p>
17471747
* <important>
17481748
* <p>Your mail is encrypted by Amazon SES using the Amazon S3 encryption client before the mail
17491749
* is submitted to Amazon S3 for storage. It is not encrypted using Amazon S3 server-side
@@ -1752,12 +1752,43 @@ export interface S3Action {
17521752
* Amazon Web Services KMS keys for decryption. This encryption client is currently available with
17531753
* the <a href="http://aws.amazon.com/sdk-for-java/">Amazon Web Services SDK for Java</a> and
17541754
* <a href="http://aws.amazon.com/sdk-for-ruby/">Amazon Web Services SDK for Ruby</a> only. For
1755-
* more information about client-side encryption using Amazon Web Services KMS master keys, see the
1755+
* more information about client-side encryption using Amazon Web Services KMS managed keys, see the
17561756
* <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html">Amazon S3 Developer Guide</a>.</p>
17571757
* </important>
17581758
* @public
17591759
*/
17601760
KmsKeyArn?: string;
1761+
1762+
/**
1763+
* <p> The ARN of the IAM role to be used by Amazon Simple Email Service while writing to the Amazon S3 bucket,
1764+
* optionally encrypting your mail via the provided customer managed key, and publishing to
1765+
* the Amazon SNS topic.
1766+
* This role should have access to the following APIs:
1767+
* </p>
1768+
* <ul>
1769+
* <li>
1770+
* <p>
1771+
* <code>s3:PutObject</code>, <code>kms:Encrypt</code> and
1772+
* <code>kms:GenerateDataKey</code> for the given Amazon S3 bucket.</p>
1773+
* </li>
1774+
* <li>
1775+
* <p>
1776+
* <code>kms:GenerateDataKey</code> for the given Amazon Web Services KMS customer managed key.
1777+
* </p>
1778+
* </li>
1779+
* <li>
1780+
* <p>
1781+
* <code>sns:Publish</code> for the given Amazon SNS topic.</p>
1782+
* </li>
1783+
* </ul>
1784+
* <note>
1785+
* <p>If an IAM role ARN is provided, the role (and only the role) is used to access all
1786+
* the given resources (Amazon S3 bucket, Amazon Web Services KMS customer managed key and Amazon SNS topic).
1787+
* Therefore, setting up individual resource access permissions is not required.</p>
1788+
* </note>
1789+
* @public
1790+
*/
1791+
IamRoleArn?: string;
17611792
}
17621793

17631794
/**
@@ -4237,7 +4268,7 @@ export interface SendBulkTemplatedEmailRequest {
42374268
* the keys correspond to replacement tags in the email template.</p>
42384269
* @public
42394270
*/
4240-
DefaultTemplateData?: string;
4271+
DefaultTemplateData: string | undefined;
42414272

42424273
/**
42434274
* <p>One or more <code>Destination</code> objects. All of the recipients in a

‎clients/client-ses/src/protocols/Aws_query.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5164,6 +5164,9 @@ const se_S3Action = (input: S3Action, context: __SerdeContext): any => {
51645164
if (input[_KKA] != null) {
51655165
entries[_KKA] = input[_KKA];
51665166
}
5167+
if (input[_IRA] != null) {
5168+
entries[_IRA] = input[_IRA];
5169+
}
51675170
return entries;
51685171
};
51695172

@@ -7490,6 +7493,9 @@ const de_S3Action = (output: any, context: __SerdeContext): S3Action => {
74907493
if (output[_KKA] != null) {
74917494
contents[_KKA] = __expectString(output[_KKA]);
74927495
}
7496+
if (output[_IRA] != null) {
7497+
contents[_IRA] = __expectString(output[_IRA]);
7498+
}
74937499
return contents;
74947500
};
74957501

@@ -8085,6 +8091,7 @@ const _HV = "HeaderValue";
80858091
const _I = "Identity";
80868092
const _IAMRARN = "IAMRoleARN";
80878093
const _IF = "IpFilter";
8094+
const _IRA = "IamRoleArn";
80888095
const _IT = "InvocationType";
80898096
const _ITd = "IdentityType";
80908097
const _Id = "Identities";

‎codegen/sdk-codegen/aws-models/ses.json

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3150,6 +3150,16 @@
31503150
"com.amazonaws.ses#HtmlPart": {
31513151
"type": "string"
31523152
},
3153+
"com.amazonaws.ses#IAMRoleARN": {
3154+
"type": "string",
3155+
"traits": {
3156+
"smithy.api#length": {
3157+
"min": 20,
3158+
"max": 2048
3159+
},
3160+
"smithy.api#pattern": "^arn:[\\w-]+:iam::[0-9]+:role/[\\w-]+$"
3161+
}
3162+
},
31533163
"com.amazonaws.ses#Identity": {
31543164
"type": "string"
31553165
},
@@ -4986,7 +4996,13 @@
49864996
"KmsKeyArn": {
49874997
"target": "com.amazonaws.ses#AmazonResourceName",
49884998
"traits": {
4989-
"smithy.api#documentation": "<p>The customer master key that Amazon SES should use to encrypt your emails before saving\n them to the Amazon S3 bucket. You can use the default master key or a custom master key that\n you created in Amazon Web Services KMS as follows:</p>\n <ul>\n <li>\n <p>To use the default master key, provide an ARN in the form of\n <code>arn:aws:kms:REGION:ACCOUNT-ID-WITHOUT-HYPHENS:alias/aws/ses</code>.\n For example, if your Amazon Web Services account ID is 123456789012 and you want to use the\n default master key in the US West (Oregon) Region, the ARN of the default master\n key would be <code>arn:aws:kms:us-west-2:123456789012:alias/aws/ses</code>. If\n you use the default master key, you don't need to perform any extra steps to\n give Amazon SES permission to use the key.</p>\n </li>\n <li>\n <p>To use a custom master key that you created in Amazon Web Services KMS, provide the ARN of\n the master key and ensure that you add a statement to your key's policy to give\n Amazon SES permission to use it. For more information about giving permissions, see\n the <a href=\"https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html\">Amazon SES Developer\n Guide</a>.</p>\n </li>\n </ul>\n <p>For more information about key policies, see the <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Amazon Web Services KMS Developer Guide</a>. If\n you do not specify a master key, Amazon SES does not encrypt your emails.</p>\n <important>\n <p>Your mail is encrypted by Amazon SES using the Amazon S3 encryption client before the mail\n is submitted to Amazon S3 for storage. It is not encrypted using Amazon S3 server-side\n encryption. This means that you must use the Amazon S3 encryption client to decrypt the\n email after retrieving it from Amazon S3, as the service has no access to use your\n Amazon Web Services KMS keys for decryption. This encryption client is currently available with\n the <a href=\"http://aws.amazon.com/sdk-for-java/\">Amazon Web Services SDK for Java</a> and\n <a href=\"http://aws.amazon.com/sdk-for-ruby/\">Amazon Web Services SDK for Ruby</a> only. For\n more information about client-side encryption using Amazon Web Services KMS master keys, see the\n <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html\">Amazon S3 Developer Guide</a>.</p>\n </important>"
4999+
"smithy.api#documentation": "<p>The customer managed key that Amazon SES should use to encrypt your emails before saving\n them to the Amazon S3 bucket. You can use the default managed key or a custom managed key that\n you created in Amazon Web Services KMS as follows:</p>\n <ul>\n <li>\n <p>To use the default managed key, provide an ARN in the form of\n <code>arn:aws:kms:REGION:ACCOUNT-ID-WITHOUT-HYPHENS:alias/aws/ses</code>.\n For example, if your Amazon Web Services account ID is 123456789012 and you want to use the\n default managed key in the US West (Oregon) Region, the ARN of the default master\n key would be <code>arn:aws:kms:us-west-2:123456789012:alias/aws/ses</code>. If\n you use the default managed key, you don't need to perform any extra steps to\n give Amazon SES permission to use the key.</p>\n </li>\n <li>\n <p>To use a custom managed key that you created in Amazon Web Services KMS, provide the ARN of\n the managed key and ensure that you add a statement to your key's policy to give\n Amazon SES permission to use it. For more information about giving permissions, see\n the <a href=\"https://docs.aws.amazon.com/ses/latest/dg/receiving-email-permissions.html\">Amazon SES Developer\n Guide</a>.</p>\n </li>\n </ul>\n <p>For more information about key policies, see the <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Amazon Web Services KMS Developer Guide</a>. If\n you do not specify a managed key, Amazon SES does not encrypt your emails.</p>\n <important>\n <p>Your mail is encrypted by Amazon SES using the Amazon S3 encryption client before the mail\n is submitted to Amazon S3 for storage. It is not encrypted using Amazon S3 server-side\n encryption. This means that you must use the Amazon S3 encryption client to decrypt the\n email after retrieving it from Amazon S3, as the service has no access to use your\n Amazon Web Services KMS keys for decryption. This encryption client is currently available with\n the <a href=\"http://aws.amazon.com/sdk-for-java/\">Amazon Web Services SDK for Java</a> and\n <a href=\"http://aws.amazon.com/sdk-for-ruby/\">Amazon Web Services SDK for Ruby</a> only. For\n more information about client-side encryption using Amazon Web Services KMS managed keys, see the\n <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html\">Amazon S3 Developer Guide</a>.</p>\n </important>"
5000+
}
5001+
},
5002+
"IamRoleArn": {
5003+
"target": "com.amazonaws.ses#IAMRoleARN",
5004+
"traits": {
5005+
"smithy.api#documentation": "<p> The ARN of the IAM role to be used by Amazon Simple Email Service while writing to the Amazon S3 bucket,\n optionally encrypting your mail via the provided customer managed key, and publishing to\n the Amazon SNS topic.\n This role should have access to the following APIs:\n </p>\n <ul>\n <li>\n <p>\n <code>s3:PutObject</code>, <code>kms:Encrypt</code> and\n <code>kms:GenerateDataKey</code> for the given Amazon S3 bucket.</p>\n </li>\n <li>\n <p>\n <code>kms:GenerateDataKey</code> for the given Amazon Web Services KMS customer managed key.\n </p>\n </li>\n <li>\n <p>\n <code>sns:Publish</code> for the given Amazon SNS topic.</p>\n </li>\n </ul>\n <note>\n <p>If an IAM role ARN is provided, the role (and only the role) is used to access all\n the given resources (Amazon S3 bucket, Amazon Web Services KMS customer managed key and Amazon SNS topic).\n Therefore, setting up individual resource access permissions is not required.</p>\n </note>"
49905006
}
49915007
}
49925008
},
@@ -5227,7 +5243,8 @@
52275243
"DefaultTemplateData": {
52285244
"target": "com.amazonaws.ses#TemplateData",
52295245
"traits": {
5230-
"smithy.api#documentation": "<p>A list of replacement values to apply to the template when replacement data is not\n specified in a Destination object. These values act as a default or fallback option when\n no other data is available.</p>\n <p>The template data is a JSON object, typically consisting of key-value pairs in which\n the keys correspond to replacement tags in the email template.</p>"
5246+
"smithy.api#documentation": "<p>A list of replacement values to apply to the template when replacement data is not\n specified in a Destination object. These values act as a default or fallback option when\n no other data is available.</p>\n <p>The template data is a JSON object, typically consisting of key-value pairs in which\n the keys correspond to replacement tags in the email template.</p>",
5247+
"smithy.api#required": {}
52315248
}
52325249
},
52335250
"Destinations": {

0 commit comments

Comments
 (0)