AWS ses documentation change

Service: ses · 2025-05-01 · Documentation medium

File: ses/latest/dg/eb-policies.md

Summary

Added policies for 'Publish to SNS' rule action, including IAM and KMS permissions

Security assessment

Introduces new security documentation for SNS/KMS permissions required for email processing rules. Enhances security guidance but does not address a specific vulnerability.

Diff

diff --git a/ses/latest/dg/eb-policies.md b/ses/latest/dg/eb-policies.md
index 230a601a4..3d810b174 100644
--- a//ses/latest/dg/eb-policies.md
+++ b//ses/latest/dg/eb-policies.md
@@ -271 +271 @@ The SES rules execution role is an AWS Identity and Access Management (IAM) role
-Thus, the following trust policy is required in addition to the individual permission policies in this section required to execute the _Write to S3_ , _Deliver to mailbox_ , and _Send to internet_ rule actions.
+Thus, the following trust policy is required _in addition to_ the individual permission policies in this section required to execute each specific rule action.
@@ -294,0 +295,15 @@ Thus, the following trust policy is required in addition to the individual permi
+###### Rule action policies
+
+  * Write to S3 policy
+
+  * Deliver to mailbox policy
+
+  * Send to internet policy
+
+  * Deliver to Q Business policy
+
+  * Publish to SNS policy
+
+
+
+
@@ -438,0 +454,57 @@ KMS policy for Amazon Q Business:
+                }
+            }
+        ]
+    }
+
+For more information about attaching policies to AWS KMS keys, see [Using Key Policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) in the _AWS Key Management Service Developer Guide_.
+
+### Permission policy for _Publish to SNS_ rule action 
+
+The following policies are required to use the **Publish to SNS** rule action, which delivers the received email to an Amazon SNS topic.
+
+Amazon SNS policy:
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowAccessToSNSTopic",
+                "Effect": "Allow",
+                "Action": [
+                    "sns:Publish"
+                ],
+                "Resource": [
+                    "arn:aws:sns:us-east-1:888888888888:MySnsTopic"
+                ]
+            }
+        ]
+    }
+
+KMS policy for Amazon SNS:
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Sid": "AllowAccessToKMSKeyForSNS",
+                "Effect": "Allow",
+                "Action": [
+                    "kms:GenerateDataKey*",
+                    "kms:Encrypt",
+                    "kms:DescribeKey"
+                ],
+                "Resource": [
+                    "arn:aws:kms:us-east-1:888888888888:key/*"
+                ],
+                "Condition": {
+                    "StringEquals": {
+                        "kms:ViaService": "qbusiness.us-east-1.amazonaws.com",
+                        "kms:CallerAccount": "888888888888"
+                     },
+                     "ForAnyValue:StringEquals": {
+                        "kms:ResourceAliases": [
+                            "alias/MyKeyAlias"
+                        ]
+                    }