feat(ses): https policy for custom tracking domain #34314

badmintoncryer · 2025-04-30T07:57:25Z

Issue # (if applicable)

None

Reason for this change

Cloudformation supports for configuring HttpsPolicy for custom tracking domain in ConfigurationSet but AWS CDK cannot do this.

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-ses-configurationset-trackingoptions.html#cfn-ses-configurationset-trackingoptions-httpspolicy

Description of changes

Define HttpsPolicy enum
Add customTrackingHttpsPolicy to ConfigurationSetProps

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

badmintoncryer · 2025-04-30T08:07:19Z

packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts

@@ -189,6 +216,9 @@ export class ConfigurationSet extends Resource implements IConfigurationSet {
        throw new ValidationError(`The maximum delivery duration must be less than or equal to 14 hours (50400 seconds), got: ${props.maxDeliveryDuration.toSeconds()} seconds.`, this);
      }
    }
+    if (props.customTrackingHttpsPolicy && !props.customTrackingRedirectDomain) {


Cloudformation causes deployment error in this condition.

code

new ses.ConfigurationSet(this, 'ConfigurationSet', { // customTrackingRedirectDomain: 'tracking.naonao.com', customTrackingHttpsPolicy: ses.HttpsPolicy.OPTIONAL, });

result

Resource handler returned message: "1 validation error detected: Value at 'trackingOptions.customRedirectDomain' failed to satisfy constraint: Member must not be null (Service: SesV2, Status Code: 400, Request ID: 866fb1c3-dd63-454f-94ec-2ca1bc7b7b1d)" (RequestToken: 05ae07af-ba64-77f8-0cbc-da45a39b8d5f, HandlerErrorCode: InvalidRequest)

badmintoncryer · 2025-04-30T08:28:43Z

packages/aws-cdk-lib/aws-ses/lib/configuration-set.ts

+  /**
+   * The https policy to use for tracking open and click events.
+   *
+   * @default - HttpsPolicy.OPTIONAL if customTrackingRedirectDomain is set, otherwise undefined


SES default behavior is described in here.

Optional – (Default behavior) Open tracking links will be wrapped using HTTP.

https://docs.aws.amazon.com/ses/latest/dg/creating-configuration-sets.html

go-to-k

Looks good. Left very minor comments. But I can approve it as is if it's better the way it is :)

go-to-k · 2025-05-12T09:58:52Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

+new integ.IntegTest(app, 'ConfigurationSetInteg', {
+  testCases: [new ConfigurationSetStack(app, 'ses-configuration-set-tracking-options-integ', {
+    hostedZoneId,
+    hostedZoneName,
+    domainName,
+  })],
+});


How about specifying enableLookups: true and stackUpdateWorkflow: false options just in case we forget --disable-update-workflow for the integ command?

I don't know that these options have the same meanings. Thanks!

Sorry, I misunderstood. The fromHostedZoneAttributes does not look up, so the enableLookups: true was not needed. Could you please remove it?

go-to-k · 2025-05-12T10:02:03Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

+interface TestStackProps extends StackProps {
+  hostedZoneId: string;
+  hostedZoneName: string;
+  domainName: string;


Isn't the domainName unnecessary?

go-to-k · 2025-05-12T10:22:39Z

...tions.js.snapshot/sesconfigurationsettrackingoptionsintegIdentityStack5770606B.template.json

+  "EmailIdentity7187767D": {
+   "Type": "AWS::SES::EmailIdentity",
+   "Properties": {
+    "EmailIdentity": "naonao.org"


Is it okay if you don't keep it hidden?

I thought there was no particular problem, but just to be safe, I'll use example.com!

~~I thought that in CI, the domain name would always be example.com, but why were the tests passing without any problems..??~~

I noticed that this value is derived from not CDK_INTEG_DOMAIN_NAME but CDK_INTEG_HOSTED_ZONE_NAME. But I still don't understand why this integ test had passed. I'll wait for the CI result.

I see, I missed it.

new integ.IntegTest(app, 'ConfigurationSetInteg', { testCases: [new ConfigurationSetStack(app, 'ses-configuration-set-tracking-options-integ', { hostedZoneId, hostedZoneName, })],

Two stacks must be explicitly specified for testCases. The stack not specified would not be checked.

This means that we must generate the two stacks separately, ~~define their dependencies with addDependency~~, and specify the stacks in testCases.

Also, you now specify ConfigurationSetStack for the scope of IdentityStack, but need to specify app instead.

P.S.

define their dependencies with addDependency

The value originally generated by IdentityStack is used by ConfigurationSetStack, so no explicit dependency is needed.

However, if you make it a target of snapshot verification, this test can only be performed by you who own that domain in the future.
For this reason, we would need to either exclude the stack from the targets, or prompt developers to rewrite the generated template. (If it is good and safe to detect changes to the stack by other PRs about the EmailIdentity too, would the latter be a good idea...? like: https://github.com/aws/aws-cdk/blob/v2.195.0/packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-ecr-build-and-publish-private.ts#L15)

Actually, since domain verification on EmailIdentity takes several dozen seconds, when defined as two stacks with dependencies on the same app, the ConfigurationSetStack deployment begins before authentication is complete, resulting in a deployment error. At first, I had created this integ test like that.

As a workaround, I've made it a nested stack to significantly delay the start of ConfigurationSetStack deployment, ensuring that deployment executes after domain verification is complete.
(Therefore, I think this test deployment could be flaky and may fail in some cases.)

I'm wondering if it might be better to simply create EmailIdentity in advance and only test ConfigurationSetStack.
What do you think?

I'm wondering if it might be better to simply create EmailIdentity in advance and only test ConfigurationSetStack.

Agree with it! There should be no need to make this in CDK.

I've updated integ test like that!

badmintoncryer · 2025-05-12T14:58:17Z

@go-to-k Thank you for your review!! I've addressed your comments.

update domain name

go-to-k · 2025-05-13T14:02:44Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

+ *
+ * Step 1: Create a public hosted zone in Route53
+ * Step 2: Create a email identity in SES and validate it with the hosted zone
+ * Step 3: Set the domain name as an env var "DOMAIN_NAME"


const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;

In this case, CDK_INTEG_DOMAIN_NAME is set to '*.example.com' in integ-runner.

https://github.com/aws/aws-cdk-cli/blob/main/packages/@aws-cdk/integ-runner/lib/runner/runner-base.ts#L433

At this time, even if we set DOMAIN_NAME, it won't be reflected?

CDK_INTEG_DOMAIN_NAME is only set in CI environment and I could execute integ test with my domain by setting DOMAIN_NAME. (But I don't know why the CDK_INTEG_DOMAIN_NAME env is not set during local integ test execution.)

This implementation is used in other integ tests.

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.dns-validated-certificate.ts#L22

Additionally, I need to add to the procedure that the domain name must be corrected to example.com in the generated CloudFormation template.

go-to-k · 2025-05-14T05:08:40Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
-const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
+const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;


Isn't it CDK_INTEG_HOSTED_ZONE_NAME (example.com) instead of CDK_INTEG_DOMAIN_NAME (*.example.com)?

related: https://github.com/aws/aws-cdk/pull/34314/files#r2086912984

You are exactly right! I'll fix this.

go-to-k

Thanks for the changes, LGTM!

badmintoncryer · 2025-05-14T15:21:27Z

@go-to-k Thanks always!

samson-keung · 2025-05-15T05:26:08Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

+  testCases: [new ConfigurationSetStack(app, 'ses-configuration-set-tracking-options-integ', {
+    hostedZoneName,
+  })],
+  stackUpdateWorkflow: false,


wondering why disable the update workflow?

This is described in here and I don't know why this is required..

I see. Thanks for the pointer. Make sense to skip the update workflow as the fake hosted zone name will not deploy successfully.

aws-cdk-automation · 2025-05-15T09:41:45Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: f361776
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

samson-keung

LGTM

samson-keung · 2025-05-15T17:29:12Z

...ws-cdk-testing/framework-integ/test/aws-ses/test/integ.configuration-set-tracking-options.ts

+  testCases: [new ConfigurationSetStack(app, 'ses-configuration-set-tracking-options-integ', {
+    hostedZoneName,
+  })],
+  stackUpdateWorkflow: false,


I see. Thanks for the pointer. Make sense to skip the update workflow as the fake hosted zone name will not deploy successfully.

mergify · 2025-05-15T17:29:55Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-05-15T17:30:12Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

badmintoncryer added 4 commits April 29, 2025 23:20

add integ test

f4a1a25

update unit test

7380e6b

add validation

4b5ae9e

update readme

ee095b0

aws-cdk-automation requested a review from a team April 30, 2025 07:57

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Apr 30, 2025

aws-cdk-automation previously requested changes Apr 30, 2025

View reviewed changes

badmintoncryer changed the title ~~feat~~ feat(ses): https policy for custom tracking domain Apr 30, 2025

badmintoncryer added 2 commits April 30, 2025 17:03

Merge branch 'main' into ses-https-policy

c613796

update comments

a55aacd

badmintoncryer commented Apr 30, 2025

View reviewed changes

update jsdoc

216ce9e

badmintoncryer commented Apr 30, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 30, 2025

github-actions bot mentioned this pull request May 1, 2025

Monthly PR metrics report #34324

Open

Merge branch 'main' into ses-https-policy

20cb832

go-to-k reviewed May 12, 2025

View reviewed changes

badmintoncryer added 2 commits May 12, 2025 22:17

update integ

6277f0f

Merge branch 'main' into ses-https-policy

285fabd

badmintoncryer added 2 commits May 13, 2025 21:54

Merge branch 'main' into ses-https-policy

2faf046

update integ test

6db3e24

update domain name

badmintoncryer force-pushed the ses-https-policy branch from 84fe08d to 6db3e24 Compare May 13, 2025 13:13

go-to-k reviewed May 13, 2025

View reviewed changes

go-to-k reviewed May 14, 2025

View reviewed changes

badmintoncryer added 2 commits May 14, 2025 23:05

fix integ test

56a4b83

Merge branch 'main' into ses-https-policy

20bb6a9

Merge branch 'main' into ses-https-policy

f44090d

go-to-k approved these changes May 14, 2025

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels May 14, 2025

badmintoncryer added 2 commits May 15, 2025 09:27

Merge branch 'main' into ses-https-policy

54227c0

Merge branch 'main' into ses-https-policy

9af28a6

samson-keung reviewed May 15, 2025

View reviewed changes

samson-keung self-assigned this May 15, 2025

Merge branch 'main' into ses-https-policy

f361776

samson-keung approved these changes May 15, 2025

View reviewed changes

mergify bot merged commit 60d7aea into aws:main May 15, 2025
18 checks passed

github-actions bot locked as resolved and limited conversation to collaborators May 15, 2025

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 15, 2025

feat(ses): https policy for custom tracking domain #34314

feat(ses): https policy for custom tracking domain #34314

Uh oh!

Conversation

badmintoncryer commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

code

result

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented May 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

badmintoncryer May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

go-to-k left a comment

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented May 14, 2025

Uh oh!

Choose a reason for hiding this comment

badmintoncryer commented Apr 30, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

badmintoncryer Apr 30, 2025 •

edited

Loading

go-to-k May 13, 2025 •

edited

Loading

badmintoncryer May 12, 2025 •

edited

Loading

go-to-k May 13, 2025 •

edited

Loading

go-to-k May 13, 2025 •

edited

Loading

badmintoncryer May 14, 2025 •

edited

Loading

go-to-k May 14, 2025 •

edited

Loading