aws_ses_receipt_rule Resource

Use the aws_ses_receipt_rule InSpec audit resource to test properties of the singular resource of AWS Simple Email Service (SES) receipt rule.

The AWS::SES::ReceiptRule resource specifies a receipt rule.

For additional information, including details on parameters and properties, see the AWS documentation on AWS SES ReceiptRule.

Installation

This resource is available in the Chef InSpec AWS resource pack.

See the Chef InSpec documentation on cloud platforms for information on configuring your AWS environment for InSpec and creating an InSpec profile that uses the InSpec AWS resource pack.

Syntax

Ensure that the rule exists.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
  it { should exist }
end

Parameters

rule_set_name (required)

The name of the receipt rule set that the receipt rule belongs to.

rule_name (required)

The name of the receipt rule.

Properties

name

The name of the receipt rule.

enabled

If true, the receipt rule is active. The default value is false.

tls_policy

Specifies whether Amazon SES should require that incoming email is delivered over a connection encrypted with Transport Layer Security (TLS).

recipients

The recipient domains and email addresses that the receipt rule applies to.

actions

An ordered list of actions to perform on messages that match at least one of the recipient email addresses or domains specified in the receipt rule.

s3_action_topic_arns

The ARN of the Amazon SNS topic to notify when the message is saved to the Amazon S3 bucket.

s3_action_bucket_names

The name of the Amazon S3 bucket that incoming email will be saved to.

s3_action_object_key_prefixes

The key prefix of the Amazon S3 bucket.

s3_action_kms_key_arns

The customer master key that Amazon SES should use to encrypt your emails before saving them to the Amazon S3 bucket.

bounce_action_topic_arns

The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the bounce action is taken.

bounce_action_smtp_reply_codes

The SMTP reply code, as defined by RFC 5321.

bounce_action_status_codes

The SMTP enhanced status code, as defined by RFC 3463.

bounce_action_messages

Human-readable text to include in the bounce message.

bounce_action_senders

The email address of the sender of the bounced email.

workmail_action_topic_arns

The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the WorkMail action is called.

workmail_action_organization_arns

The ARN of the Amazon WorkMail organization.

lambda_action_topic_arns

The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the Lambda action is taken.

lambda_action_function_arns

The Amazon Resource Name (ARN) of the AWS Lambda function.

lambda_action_invocation_types

The invocation type of the AWS Lambda function.

stop_action_scopes

The scope of the StopAction. The only acceptable value is RuleSet.

stop_action_topic_arns

The Amazon Resource Name (ARN) of the Amazon SNS topic to notify when the stop action is taken.

add_header_action_header_names

The name of the header to add. Must be between 1 and 50 characters, inclusive, and consist of alphanumeric (a-z, A-Z, 0-9) characters and dashes only.

add_header_action_header_values

Must be less than 2048 characters, and must not contain newline characters (“r” or “n”).

sns_action_topic_arns

The Amazon Resource Name (ARN) of the Amazon SNS topic to notify.

sns_action_encodings

The encoding to use for the email within the Amazon SNS notification.

scan_enabled

If true, then messages that this receipt rule applies to are scanned for spam and viruses. The default value is false.

Examples

Ensure a rule is available.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
  its('name') { should eq 'RULE_NAME' }
end

Ensure that scan_enabled is true so that messages that this receipt rule is applied to are scanned for spam and viruses.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
    its('scan_enabled') { should eq true }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.

The controls will pass if the describe method returns at least one result.

exist

Use should to test that the entity exists.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
  it { should exist }
end

Use should_not to test the entity does not exist.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
  it { should_not exist }
end

be_available

Use should to check if the entity is available.

describe aws_ses_receipt_rule(rule_set_name: 'RULE_SET_NAME', rule_name: 'RULE_NAME') do
  it { should be_available }
end

AWS Permissions

Your Principal will need the SES:Client:DescribeReceiptRuleResponse action with Effect set to Allow.