@mettlecast/domain-cdk-packer 0.2.105 → 0.2.107

package/dist/DomainStack.js

@@ -820,14 +820,16 @@ export class DomainStack extends cdk.Stack {
             }
         }
         // Grant SES SendEmail permission when a verified sending address is configured.
-        // Scoped to the SES identity ARN derived from SES_FROM_EMAIL (e.g. an
-        // address or domain identity) — least-privilege. Falls back to 'arn:aws:ses:*:*:*'
-        // only when the address is not address-shaped (tests/local).
+        // Scoped to the SES identity ARN derived from SES_FROM_EMAIL — least-privilege.
+        // SES_FROM_EMAIL may be address-shaped (noreply@example.com) or a bare domain
+        // (example.com). The Email Domain settings tab always creates a *domain*
+        // identity, so an address-shaped value must be reduced to its domain part:
+        // scoping to `identity/noreply@example.com` would not match the created
+        // `identity/example.com` and ses:SendEmail would be denied at runtime.
         if (process.env['SES_FROM_EMAIL']) {
             const sesFrom = process.env['SES_FROM_EMAIL'];
-            const sesIdentity = sesFrom.includes('@')
-                ? `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`
-                : `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`;
+            const sesIdentityDomain = (sesFrom.includes('@') ? sesFrom.split('@')[1] : sesFrom).toLowerCase();
+            const sesIdentity = `arn:aws:ses:${this.region}:${this.account}:identity/${sesIdentityDomain}`;
             for (const fn of allDomainLambdas) {
                 fn.addToRolePolicy(new iam.PolicyStatement({
                     actions: ['ses:SendEmail', 'ses:SendRawEmail'],

package/dist/__tests__/domain-stack.test.js

@@ -1,4 +1,4 @@
-import { describe, it, expect, afterAll } from 'vitest';
+import { describe, it, expect, afterAll, afterEach } from 'vitest';
 import * as cdk from 'aws-cdk-lib';
 import { Template } from 'aws-cdk-lib/assertions';
 import fs from 'node:fs';
@@ -633,4 +633,68 @@ describe('DomainStack', () => {
             expect(hasScopedPutEvents).toBe(true);
         });
     });
+    /**
+     * Review finding H1 (#5292): the ses:SendEmail/ses:SendRawEmail grant must
+     * scope to the *domain* SES identity that the Email Domain settings tab
+     * creates. SES_FROM_EMAIL is address-shaped (`noreply@example.com`) after
+     * sender activation — building `identity/noreply@example.com` would never
+     * match the created `identity/example.com` and email would be denied.
+     */
+    describe('SES send grant scoped to the domain identity (#5292 H1)', () => {
+        const originalSesFromEmail = process.env.SES_FROM_EMAIL;
+        afterEach(() => {
+            if (originalSesFromEmail === undefined)
+                delete process.env.SES_FROM_EMAIL;
+            else
+                process.env.SES_FROM_EMAIL = originalSesFromEmail;
+        });
+        const sesResourceStrings = (template) => Object.values(template.findResources('AWS::IAM::Policy')).flatMap(p => p.Properties.PolicyDocument.Statement
+            .filter(s => s.Action?.includes('ses:SendEmail'))
+            .map(s => JSON.stringify(s.Resource)));
+        it('scopes an address-shaped SES_FROM_EMAIL to identity/example.com, never identity/noreply@example.com', () => {
+            process.env.SES_FROM_EMAIL = 'noreply@example.com';
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackSesAddress', {
+                registry: minimalRegistry,
+                eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            const resources = sesResourceStrings(template);
+            expect(resources.length).toBeGreaterThan(0);
+            for (const resource of resources) {
+                expect(resource).toContain('identity/example.com');
+                expect(resource).not.toContain('identity/noreply@example.com');
+            }
+        });
+        it('keeps plain-domain behavior: a bare domain SES_FROM_EMAIL scopes to identity/example.com', () => {
+            process.env.SES_FROM_EMAIL = 'example.com';
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackSesDomain', {
+                registry: minimalRegistry,
+                eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            const resources = sesResourceStrings(template);
+            expect(resources.length).toBeGreaterThan(0);
+            for (const resource of resources) {
+                expect(resource).toContain('identity/example.com');
+            }
+        });
+        it('omits the SES grant when SES_FROM_EMAIL is not set', () => {
+            delete process.env.SES_FROM_EMAIL;
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackSesUnset', {
+                registry: minimalRegistry,
+                eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            expect(sesResourceStrings(template)).toHaveLength(0);
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.105",
+  "version": "0.2.107",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",