AWS cli documentation change
Summary
Substantial restructuring of rule configuration documentation including: 1) Reordered parameters in tagged union structures 2) Added MIME header analysis and Add On integration in string conditions 3) Enhanced encryption documentation for S3 writes 4) Clarified IAM role requirements for actions 5) Reorganized action execution order and failure policies
Security assessment
The changes add documentation for security-related features including KMS encryption (S3SseKmsKeyId), IAM role permission requirements, and email analysis capabilities through Add On integrations. However, there is no evidence of addressing specific vulnerabilities or security incidents.
Diff
diff --git a/cli/latest/reference/mailmanager/update-rule-set.md b/cli/latest/reference/mailmanager/update-rule-set.md index db887e021..c46966ad3 100644 --- a//cli/latest/reference/mailmanager/update-rule-set.md +++ b//cli/latest/reference/mailmanager/update-rule-set.md @@ -15 +15 @@ - * [AWS CLI 2.27.51 Command Reference](../../index.html) » + * [AWS CLI 2.27.54 Command Reference](../../index.html) » @@ -110 +110 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->> Actions -> (list) +>> Name -> (string) @@ -112,159 +112 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>> The list of actions to execute when the conditions match the incoming email, and none of the “unless conditions” match. ->>> ->>> (tagged union structure) ->>> ->>>> The action for a rule to take. Only one of the contained actions can be set. ->>>> ->>>> ### Note ->>>> ->>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `AddHeader`, `Archive`, `DeliverToMailbox`, `DeliverToQBusiness`, `Drop`, `PublishToSns`, `Relay`, `ReplaceRecipient`, `Send`, `WriteToS3`. ->>>> ->>>> AddHeader -> (structure) ->>>> ->>>>> This action adds a header. This can be used to add arbitrary email headers. ->>>>> ->>>>> HeaderName -> (string) ->>>>> ->>>>>> The name of the header to add to an email. The header must be prefixed with “X-”. Headers are added regardless of whether the header name pre-existed in the email. ->>>>> ->>>>> HeaderValue -> (string) ->>>>> ->>>>>> The value of the header to add to the email. ->>>> ->>>> Archive -> (structure) ->>>> ->>>>> This action archives the email. This can be used to deliver an email to an archive. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified archive has been deleted. ->>>>> ->>>>> TargetArchive -> (string) ->>>>> ->>>>>> The identifier of the archive to send the email to. ->>>> ->>>> DeliverToMailbox -> (structure) ->>>> ->>>>> This action delivers an email to a WorkMail mailbox. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the mailbox ARN is no longer valid. ->>>>> ->>>>> MailboxArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of a WorkMail organization to deliver the email to. ->>>>> ->>>>> RoleArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of an IAM role to use to execute this action. The role must have access to the workmail:DeliverToMailbox API. ->>>> ->>>> DeliverToQBusiness -> (structure) ->>>> ->>>>> This action delivers an email to an Amazon Q Business application for ingestion into its knowledge base. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified application has been deleted or the role lacks necessary permissions to call the `qbusiness:BatchPutDocument` API. ->>>>> ->>>>> ApplicationId -> (string) ->>>>> ->>>>>> The unique identifier of the Amazon Q Business application instance where the email content will be delivered. ->>>>> ->>>>> IndexId -> (string) ->>>>> ->>>>>> The identifier of the knowledge base index within the Amazon Q Business application where the email content will be stored and indexed. ->>>>> ->>>>> RoleArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of the IAM Role to use while delivering to Amazon Q Business. This role must have access to the `qbusiness:BatchPutDocument` API for the given application and index. ->>>> ->>>> Drop -> (structure) ->>>> ->>>>> This action terminates the evaluation of rules in the rule set. ->>>> ->>>> PublishToSns -> (structure) ->>>> ->>>>> This action publishes the email content to an Amazon SNS topic. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, specified SNS topic has been deleted or the role lacks necessary permissions to call the `sns:Publish` API. ->>>>> ->>>>> Encoding -> (string) ->>>>> ->>>>>> The encoding to use for the email within the Amazon SNS notification. The default value is `UTF-8` . Use `BASE64` if you need to preserve all special characters, especially when the original message uses a different encoding format. ->>>>> ->>>>> PayloadType -> (string) ->>>>> ->>>>>> The expected payload type within the Amazon SNS notification. `CONTENT` attempts to publish the full email content with 20KB of headers content. `HEADERS` extracts up to 100KB of header content to include in the notification, email content will not be included to the notification. The default value is `CONTENT` . ->>>>> ->>>>> RoleArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of the IAM Role to use while writing to Amazon SNS. This role must have access to the `sns:Publish` API for the given topic. ->>>>> ->>>>> TopicArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of the Amazon SNS Topic to which notification for the email received will be published. ->>>> ->>>> Relay -> (structure) ->>>> ->>>>> This action relays the email to another SMTP server. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified relay has been deleted. ->>>>> ->>>>> MailFrom -> (string) ->>>>> ->>>>>> This action specifies whether to preserve or replace original mail from address while relaying received emails to a destination server. ->>>>> ->>>>> Relay -> (string) ->>>>> ->>>>>> The identifier of the relay resource to be used when relaying an email. ->>>> ->>>> ReplaceRecipient -> (structure) ->>>> ->>>>> The action replaces certain or all recipients with a different set of recipients. ->>>>> ->>>>> ReplaceWith -> (list) ->>>>> ->>>>>> This action specifies the replacement recipient email addresses to insert. ->>>>>> ->>>>>> (string) ->>>> ->>>> Send -> (structure) ->>>> ->>>>> This action sends the email to the internet. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the caller does not have the permissions to call the sendRawEmail API. ->>>>> ->>>>> RoleArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of the role to use for this action. This role must have access to the ses:SendRawEmail API. ->>>> ->>>> WriteToS3 -> (structure) ->>>> ->>>>> This action writes the MIME content of the email to an S3 bucket. ->>>>> ->>>>> ActionFailurePolicy -> (string) ->>>>> ->>>>>> A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified the bucket has been deleted. ->>>>> ->>>>> RoleArn -> (string) ->>>>> ->>>>>> The Amazon Resource Name (ARN) of the IAM Role to use while writing to S3. This role must have access to the s3:PutObject, kms:Encrypt, and kms:GenerateDataKey APIs for the given bucket. ->>>>> ->>>>> S3Bucket -> (string) ->>>>> ->>>>>> The bucket name of the S3 bucket to write to. ->>>>> ->>>>> S3Prefix -> (string) ->>>>> ->>>>>> The S3 prefix to use for the write to the s3 bucket. ->>>>> ->>>>> S3SseKmsKeyId -> (string) ->>>>> ->>>>>> The KMS Key ID to use to encrypt the message in S3. +>>> The user-friendly name of the rule. @@ -282 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `BooleanExpression`, `DmarcExpression`, `IpExpression`, `NumberExpression`, `StringExpression`, `VerdictExpression`. +>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `BooleanExpression`, `StringExpression`, `NumberExpression`, `IpExpression`, `VerdictExpression`, `DmarcExpression`. @@ -294 +136,5 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `Analysis`, `Attribute`, `IsInAddressList`. +>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `Attribute`, `Analysis`, `IsInAddressList`. +>>>>>> +>>>>>> Attribute -> (string) +>>>>>> +>>>>>>> The boolean type representing the allowed attribute types for an email. @@ -308,4 +153,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>>>>> Attribute -> (string) ->>>>>> ->>>>>>> The boolean type representing the allowed attribute types for an email. ->>>>>> @@ -315,0 +158,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma +>>>>>>> Attribute -> (string) +>>>>>>> +>>>>>>>> The email attribute that needs to be evaluated against the address list. +>>>>>>> @@ -321,4 +166,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>>>>>> ->>>>>>> Attribute -> (string) ->>>>>>> ->>>>>>>> The email attribute that needs to be evaluated against the address list. @@ -330,15 +172 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/mailma ->>>> DmarcExpression -> (structure) ->>>> ->>>>> The condition applies to a DMARC policy expression passed in this field.