aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::SES::MailManagerRuleSet] - [BUG] - SnsAction TopicArn pattern rejects valid GovCloud ARNs
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource Name
AWS::SES::MailManagerRuleSet
### Issue Description
The `pattern` constraint on `AWS::SES::MailManagerRuleSet` → `SnsAction.TopicArn` rejects valid SNS topic ARNs in GovCloud regions, making the `PublishToSns` rule action unusable in GovCloud accounts.
The pattern documented in the CloudFormation Template Reference is:
```
^arn:(aws|aws-cn|aws-us-gov|aws-eusc):sns:[a-z]{2}-[a-z]+-\d{1}:\d{12}:[\w\-]{1,256}$
```
The region segment `[a-z]{2}-[a-z]+-\d{1}` matches three-segment region names like `us-east-1` but fails to match GovCloud region names like `us-gov-east-1` and `us-gov-west-1`, which have four segments. This is contradicted by the partition allowlist in the same regex, which explicitly includes `aws-us-gov`, making clear that GovCloud support was intended.
### Expected Behavior
An SNS topic ARN such as `arn:aws-us-gov:sns:us-gov-east-1:123456789012:my-topic` is accepted by the schema pattern, consistent with `aws-us-gov` being an allowed partition value.
### Observed Behavior
The pattern rejects all GovCloud SNS topic ARNs at validation time. The `PublishToSns` action cannot be configured in any GovCloud account.
### Test Cases
CloudFormation template fragment that should be valid but fails schema validation:
```yaml
Rules:
- Name: forward-to-sns
Actions:
- PublishToSns:
TopicArn: arn:aws-us-gov:sns:us-gov-east-1:123456789012:my-topic
RoleArn: arn:aws-us-gov:iam::123456789012:role/ses-publish-role
```
The same configuration works correctly in standard regions (e.g. `arn:aws:sns:us-east-1:...`).
This was tested by way of the `awscc` Terraform provider, version 1.84.0
### Other Details
The python `botocore` service model for the Mail Manager API (`mailmanager/2023-10-17/service-2.json`) defines the same field (`SnsTopicArn` shape) with the pattern `arn:(aws|aws-cn|aws-us-gov|aws-eusc):sns:[a-z0-9-]+:\d{12}:[\w\-]{1,256}` — using `[a-z0-9-]+` for the region, which correctly accepts GovCloud. So, it is probable that the AWS API itself has no problem with these ARNs and that the restriction exists only in the CloudFormation schema pattern.
Minimal fix: change the region segment from `[a-z]{2}-[a-z]+-\d{1}` to `[a-z]{2}-([a-z]+-)+\d{1}`. This allows one or more hyphenated word groups before the trailing digit, matching both `us-east-1` and `us-gov-east-1` without relaxing any other constraint.
Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ses-mailmanagerruleset-snsaction.html#cfn-ses-mailmanagerruleset-snsaction-topicarn
Recent announcement for GovCloud support of this resource: https://aws.amazon.com/about-aws/whats-new/2026/05/ses-mail-manager-available-aws-govcloud-regions/
Contributor guide
Research direction
Start by comparing the CloudFormation Template Reference pattern for AWS::SES::MailManagerRuleSet.SnsAction.TopicArn with mailmanager/2023-10-17/service-2.json, which already accepts hyphenated GovCloud regions. Locate the CloudFormation schema source for this property, update the region pattern consistently, and verify that both standard and GovCloud ARN examples validate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100