aws / aws/aws-cdk

[SES VPC Endpoints] Incorrect Service Name for HTTPS VPC Endpoints

Open
#31,669 5 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ses bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When creating SES VPC endpoints using AWS CDK, the generated endpoints are for `com.amazonaws.ap-southeast-2.email-smtp`, rather than the expected `com.amazonaws.ap-southeast-2.email` service name, which supports HTTPS for SES.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

The SES VPC endpoint generated by the CDK should have the service name `com.amazonaws.ap-southeast-2.email`, which corresponds to the HTTPS service, not the SMTP service. The `SES` service endpoint in the CDK is generating an endpoint with `com.amazonaws.ap-southeast-2.email-smtp`, which is incorrect when HTTPS is intended.

### Current Behavior

The code snippet below creates an SES VPC endpoint in CDK, but the generated resource references the `com.amazonaws.ap-southeast-2.email-smtp` service:

```python
ses_vpc_endpoint = ec2.InterfaceVpcEndpoint(
self, "SESEMAILENDPOINTTEST",
vpc=vpc,
service=ec2.InterfaceVpcEndpointAwsService.SES,
private_dns_enabled=True,
subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED)
)
```

The expected resource should reference `com.amazonaws.ap-southeast-2.email`, but instead, the output is:

```json
"serviceName": "com.amazonaws.ap-southeast-2.email-smtp"
```

### Reproduction Steps

Both of these CDK code generates same serviceName - (`ec2.InterfaceVpcEndpointAwsService.EMAIL_SMTP` and `ec2.InterfaceVpcEndpointAwsService.SES`)

```python
ses_vpc_endpoint = ec2.InterfaceVpcEndpoint(
self, "SESSMTPENDPOINTTEST",
vpc=vpc,
service=ec2.InterfaceVpcEndpointAwsService.SES,
private_dns_enabled=True,
subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED)
)
```

```python
ses_vpc_endpoint = ec2.InterfaceVpcEndpoint(
self, "SESSMTPENDPOINTTEST",
vpc=vpc,
service=ec2.InterfaceVpcEndpointAwsService.EMAIL_SMTP,
private_dns_enabled=True,
subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED)
)
```
Upon synthesis, both the resources the generated o CloudFormation stack results in same serviceName:

```json
"serviceName": "com.amazonaws.ap-southeast-2.email-smtp"
```

### Possible Solution

The CDK should generate the correct service name when `ec2.InterfaceVpcEndpointAwsService.SES` is used. The service name should point to the HTTPS endpoint `com.amazonaws.ap-southeast-2.email`, rather than the SMTP service.

### Additional Information/Context

_No response_

### CDK CLI Version

2.121.1

### Framework Version

_No response_

### Node.js Version

v20.17.0

### OS

macOS Sonoma 14.5

### Language

Python

### Language Version

3.10.13

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Python example with CDK CLI 2.121.1 and compare the synthesized serviceName for InterfaceVpcEndpointAwsService.SES and EMAIL_SMTP. Done means SES produces com.amazonaws.ap-southeast-2.email while EMAIL_SMTP remains com.amazonaws.ap-southeast-2.email-smtp.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.