aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SES::MailManagerRuleSet] - [BUG] - SnsAction TopicArn pattern rejects valid GovCloud ARNs

Open Beginner friendly
#2,509 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource Name

AWS::SES::MailManagerRuleSet

### Issue Description

The `pattern` constraint on `AWS::SES::MailManagerRuleSet` → `SnsAction.TopicArn` rejects valid SNS topic ARNs in GovCloud regions, making the `PublishToSns` rule action unusable in GovCloud accounts.

The pattern documented in the CloudFormation Template Reference is:

```
^arn:(aws|aws-cn|aws-us-gov|aws-eusc):sns:[a-z]{2}-[a-z]+-\d{1}:\d{12}:[\w\-]{1,256}$
```

The region segment `[a-z]{2}-[a-z]+-\d{1}` matches three-segment region names like `us-east-1` but fails to match GovCloud region names like `us-gov-east-1` and `us-gov-west-1`, which have four segments. This is contradicted by the partition allowlist in the same regex, which explicitly includes `aws-us-gov`, making clear that GovCloud support was intended.

### Expected Behavior

An SNS topic ARN such as `arn:aws-us-gov:sns:us-gov-east-1:123456789012:my-topic` is accepted by the schema pattern, consistent with `aws-us-gov` being an allowed partition value.

### Observed Behavior

The pattern rejects all GovCloud SNS topic ARNs at validation time. The `PublishToSns` action cannot be configured in any GovCloud account.

### Test Cases

CloudFormation template fragment that should be valid but fails schema validation:

```yaml
Rules:
- Name: forward-to-sns
Actions:
- PublishToSns:
TopicArn: arn:aws-us-gov:sns:us-gov-east-1:123456789012:my-topic
RoleArn: arn:aws-us-gov:iam::123456789012:role/ses-publish-role
```

The same configuration works correctly in standard regions (e.g. `arn:aws:sns:us-east-1:...`).

This was tested by way of the `awscc` Terraform provider, version 1.84.0

### Other Details

The python `botocore` service model for the Mail Manager API (`mailmanager/2023-10-17/service-2.json`) defines the same field (`SnsTopicArn` shape) with the pattern `arn:(aws|aws-cn|aws-us-gov|aws-eusc):sns:[a-z0-9-]+:\d{12}:[\w\-]{1,256}` — using `[a-z0-9-]+` for the region, which correctly accepts GovCloud. So, it is probable that the AWS API itself has no problem with these ARNs and that the restriction exists only in the CloudFormation schema pattern.

Minimal fix: change the region segment from `[a-z]{2}-[a-z]+-\d{1}` to `[a-z]{2}-([a-z]+-)+\d{1}`. This allows one or more hyphenated word groups before the trailing digit, matching both `us-east-1` and `us-gov-east-1` without relaxing any other constraint.

Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ses-mailmanagerruleset-snsaction.html#cfn-ses-mailmanagerruleset-snsaction-topicarn

Recent announcement for GovCloud support of this resource: https://aws.amazon.com/about-aws/whats-new/2026/05/ses-mail-manager-available-aws-govcloud-regions/

Contributor guide

Open the contributing guide

Research direction

Start by comparing the CloudFormation Template Reference pattern for AWS::SES::MailManagerRuleSet.SnsAction.TopicArn with mailmanager/2023-10-17/service-2.json, which already accepts hyphenated GovCloud regions. Locate the CloudFormation schema source for this property, update the region pattern consistently, and verify that both standard and GovCloud ARN examples validate.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.