Change log of AWS IAM permissions

2024-05-23

3 new resources, 2 new conditions | 47 updated actions, 5 updated conditions, 4 updated resources | 24 removed actions

Additions

Resources

mailmanager-smtp-relay
- Arn: arn:${Partition}:ses:${Region}:${Account}:mailmanager-smtp-relay/${RelayId}
- Conditions:
  aws:ResourceTag/${TagKey}
mailmanager-rule-set
- Arn: arn:${Partition}:ses:${Region}:${Account}:mailmanager-rule-set/${RuleSetId}
- Conditions:
  aws:ResourceTag/${TagKey}
mailmanager-traffic-policy
- Arn: arn:${Partition}:ses:${Region}:${Account}:mailmanager-traffic-policy/${TrafficPolicyId}
- Conditions:
  aws:ResourceTag/${TagKey}

Conditions

ses:MailManagerRuleSetArn
- Description: Filters access by SES Mail Manager rule set ARN
- Type: ARN
ses:MailManagerTrafficPolicyArn
- Description: Filters access by SES Mail Manager traffic policy ARN
- Type: ARN

Updates

Actions

CreateRuleSet
- Old: Grants permission to create a new IP address filter
  New: Grants permission to create a rule set
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys']
ListTrafficPolicies
- Old: Grants permission to list all of the existing custom verification email templates for your account
  New: Grants permission to list all of the traffic policies associated with your account
- New_value: []
  
  Old_value: ['ses:ApiVersion']
CreateAddonInstance
- Old: Grants permission to create a receipt rule set by cloning an existing one
  New: Grants permission to create an addon instance
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys', 'ses:AddonSubscriptionArn']
UpdateIngressPoint
- Old: Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain)
  New: Grants permission to update an ingress point
- Permissions management ⟶ Write
- New_value: [{'name': 'mailmanager-ingress-point', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'ses:MailManagerTrafficPolicyArn', 'ses:MailManagerRuleSetArn']
CreateIngressPoint
- Old: Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking
  New: Grants permission to create an ingress point
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys', 'ses:MailManagerRuleSetArn', 'ses:MailManagerTrafficPolicyArn']
- New_value: ['iam:CreateServiceLinkedRole']
  
  Old_value: []
StartArchiveExport
- Old: Grants permission to list the email identities for your account
  New: Grants permission to start an archive export
- List ⟶ Write
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
ListArchiveExports
- Old: Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),
  New: Grants permission to list all of the archive exports associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
DeleteAddonSubscription
- Old: Grants permission to creates an email template
  New: Grants permission to delete an addon subscription
- New_value: [{'name': 'addon-subscription', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
StopArchiveExport
- Old: Grants permission to list the IP address filters associated with your account
  New: Grants permission to stop archive export
- Read ⟶ Write
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
GetArchiveSearch
- Old: Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active
  New: Grants permission to get information about a search
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
GetArchive
- Old: Grants permission to delete the specified receipt rule
  New: Grants permission to get information about an archive
- Write ⟶ Read
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
DeleteRuleSet
- Old: Grants permission to delete an existing custom verification email template
  New: Grants permission to delete a rule set
- New_value: [{'name': 'mailmanager-rule-set', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetArchiveExport
- Old: Grants permission to delete the specified receipt rule set and all of the receipt rules it contains
  New: Grants permission to get information about an archive export
- Write ⟶ Read
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
DeleteRelay
- Old: Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking
  New: Grants permission to delete a SMTP relay
- New_value: [{'name': 'mailmanager-smtp-relay', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
DeleteIngressPoint
- Old: Grants permission to delete an event destination
  New: Grants permission to delete an ingress point
- New_value: [{'name': 'mailmanager-ingress-point', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
UpdateRelay
- Old: Grants permission to reorder the receipt rules within a receipt rule set
  New: Grants permission to update a SMTP relay
- New_value: [{'name': 'mailmanager-smtp-relay', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
ListIngressPoints
- Old: Grants permission to return the user's current sending limits
  New: Grants permission to list all of the ingress points associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
DeleteAddonInstance
- Old: Grants permission to create an empty receipt rule set
  New: Grants permission to delete an addon instance
- New_value: [{'name': 'addon-instance', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetArchiveMessage
- Old: Grants permission to delete an email template
  New: Grants permission to retrieve archived message
- Write ⟶ Read
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
CreateTrafficPolicy
- Old: Grants permission to create a receipt rule
  New: Grants permission to create a traffic policy
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys']
UpdateRuleSet
- Old: Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES
  New: Grants permission to update a rule set
- [{'name': 'identity', 'is_required': True}] ⟶ [{'name': 'mailmanager-rule-set', 'is_required': True}]
- ['ses:ApiVersion', 'ses:FromAddress'] ⟶ ['aws:RequestTag/${TagKey}']
TagResource
- Old: Grants permission to list the email templates present in your account
  New: Grants permission to add one or more tags (keys and values) to a specified resource
- List ⟶ Tagging
- New_value: [{'name': 'addon-instance', 'is_required': False}, {'name': 'addon-subscription', 'is_required': False}, {'name': 'mailmanager-archive', 'is_required': False}, {'name': 'mailmanager-ingress-point', 'is_required': False}, {'name': 'mailmanager-rule-set', 'is_required': False}, {'name': 'mailmanager-smtp-relay', 'is_required': False}, {'name': 'mailmanager-traffic-policy', 'is_required': False}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:TagKeys', 'aws:RequestTag/${TagKey}']
StartArchiveSearch
- Old: Grants permission to list all of the email templates for your account
  New: Grants permission to start an archive search
- List ⟶ Write
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
ListArchives
- Old: Grants permission to return the verification status and (for domain identities) the verification token for a list of identities
  New: Grants permission to list all of the archives associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
ListArchiveSearches
- Old: Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)
  New: Grants permission to list all of the archive searches associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
UntagResource
- Old: Grants permission to list all of the email addresses that have been verified in your account
  New: Grants permission to remove one or more tags (keys and values) from a specified resource
- Read ⟶ Tagging
- New_value: [{'name': 'addon-instance', 'is_required': False}, {'name': 'addon-subscription', 'is_required': False}, {'name': 'mailmanager-archive', 'is_required': False}, {'name': 'mailmanager-ingress-point', 'is_required': False}, {'name': 'mailmanager-rule-set', 'is_required': False}, {'name': 'mailmanager-smtp-relay', 'is_required': False}, {'name': 'mailmanager-traffic-policy', 'is_required': False}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:TagKeys']
CreateArchive
- Old: Grants permission to create a configuration set event destination
  New: Grants permission to create an archive
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys']
GetIngressPoint
- Old: Grants permission to return the details of the specified receipt rule
  New: Grants permission to get information about an ingress point
- New_value: [{'name': 'mailmanager-ingress-point', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetTrafficPolicy
- Old: Grants permission to return the custom email verification template for the template name you specify
  New: Grants permission to get information about a traffic policy
- New_value: [{'name': 'mailmanager-traffic-policy', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetRelay
- Old: Grants permission to return the details of the specified receipt rule set
  New: Grants permission to get information about a SMTP relay
- New_value: [{'name': 'mailmanager-smtp-relay', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetAddonSubscription
- Old: Grants permission to delete the specified IP address filter
  New: Grants permission to get information about an addon subscription
- Write ⟶ Read
- New_value: [{'name': 'addon-subscription', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
ListRelays
- Old: Grants permission to returns the user's sending statistics
  New: Grants permission to list all of the SMTP relays associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
StopArchiveSearch
- Old: Grants permission to list the receipt rule sets that exist under your account
  New: Grants permission to stop archive search
- Read ⟶ Write
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
ListRuleSets
- Old: Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify
  New: Grants permission to list all of the rule sets associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
UpdateTrafficPolicy
- Old: Grants permission to compose an email message to multiple destinations
  New: Grants permission to update a traffic policy
- [{'name': 'identity', 'is_required': True}, {'name': 'template', 'is_required': True}, {'name': 'configuration-set', 'is_required': False}] ⟶ [{'name': 'mailmanager-traffic-policy', 'is_required': True}]
- ['ses:ApiVersion', 'ses:FeedbackAddress', 'ses:FromAddress', 'ses:FromDisplayName', 'ses:Recipients'] ⟶ ['aws:RequestTag/${TagKey}']
GetArchiveSearchResults
- Old: Grants permission to return the details of the specified configuration set
  New: Grants permission to get information about search results
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
UpdateArchive
- Old: Grants permission to add or update the delivery options for a configuration set
  New: Grants permission to update an archive
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetArchiveMessageContent
- Old: Grants permission to delete the specified email address from the list of verified addresses
  New: Grants permission to retrieve archived message content
- Write ⟶ Read
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
GetRuleSet
- Old: Grants permission to return the email sending status of your account
  New: Grants permission to get information about a rule set
- New_value: [{'name': 'mailmanager-rule-set', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
CreateRelay
- Old: Grants permission to create a new custom verification email template
  New: Grants permission to create a SMTP relay
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys']
DeleteArchive
- Old: Grants permission to delete an existing configuration set
  New: Grants permission to delete an archive
- New_value: [{'name': 'mailmanager-archive', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
ListAddonSubscriptions
- Old: Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains)
  New: Grants permission to list all of the addon subscriptions associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
DeleteTrafficPolicy
- Old: Grants permission to delete the specified identity
  New: Grants permission to delete a traffic point
- New_value: [{'name': 'mailmanager-traffic-policy', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
GetAddonInstance
- Old: Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)
  New: Grants permission to get information about an addon instance
- Permissions management ⟶ Read
- New_value: [{'name': 'addon-instance', 'is_required': True}]
  
  Old_value: []
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}']
ListTagsForResource
- Old: Grants permission to list all of the configuration sets for your account
  New: Grants permission to list all of the tags associated with the resource
- List ⟶ Read
- New_value: [{'name': 'addon-instance', 'is_required': False}, {'name': 'addon-subscription', 'is_required': False}, {'name': 'mailmanager-archive', 'is_required': False}, {'name': 'mailmanager-ingress-point', 'is_required': False}, {'name': 'mailmanager-rule-set', 'is_required': False}, {'name': 'mailmanager-smtp-relay', 'is_required': False}, {'name': 'mailmanager-traffic-policy', 'is_required': False}]
  
  Old_value: []
- New_value: []
  
  Old_value: ['ses:ApiVersion']
ListAddonInstances
- Old: Grants permission to return the current status of Easy DKIM signing for an entity
  New: Grants permission to list all of the addon instances associated with your account
- Read ⟶ List
- New_value: []
  
  Old_value: ['ses:ApiVersion']
CreateAddonSubscription
- Old: Grants permission to create a new configuration set
  New: Grants permission to create an addon subscription
- ['ses:ApiVersion'] ⟶ ['aws:RequestTag/${TagKey}', 'aws:TagKeys']

Conditions

aws:ResourceTag/${TagKey}
- Old: Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding
  New: Filters access by tag key-value pairs attached to the resource
ses:MailManagerIngressPointType
- Old: Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses
  New: Filters access by SES Mail Manager ingress point type, for example OPEN or AUTH
- ArrayOfString ⟶ String
ses:AddonSubscriptionArn
- Old: Filters actions based on the "From" address that is used as the display name of a message
  New: Filters access by SES Addon Subscription ARN
- String ⟶ ARN
aws:TagKeys
- Old: Filters actions based on the "From" address of a message
  New: Filters access by the presence of tag keys in the request
- String ⟶ ArrayOfString
aws:RequestTag/${TagKey}
- Old: Filters actions based on the SES API version
  New: Filters access by the presence of tag key-value pairs in the request

Resources

mailmanager-ingress-point
- Old: arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}
  New: arn:${Partition}:ses:${Region}:${Account}:mailmanager-ingress-point/${IngressPointId}
- New_value: ['aws:ResourceTag/${TagKey}', 'ses:MailManagerIngressPointType']
  
  Old_value: []
addon-subscription
- Old: arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${TemplateName}
  New: arn:${Partition}:ses:${Region}:${Account}:addon-subscription/${AddonSubscriptionId}
- New_value: ['aws:ResourceTag/${TagKey}']
  
  Old_value: []
mailmanager-archive
- Old: arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}
  New: arn:${Partition}:ses:${Region}:${Account}:mailmanager-archive/${ArchiveId}
- New_value: ['aws:ResourceTag/${TagKey}']
  
  Old_value: []
addon-instance
- Old: arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}
  New: arn:${Partition}:ses:${Region}:${Account}:addon-instance/${AddonInstanceId}
- New_value: ['aws:ResourceTag/${TagKey}']
  
  Old_value: []

Deletions

Actions

SendCustomVerificationEmail
- Description: Grants permission to add an email address to the list of identities and attempts to verify it for your account
- Access: Write
- Resources:
  Name: identity
  
  Required: Yes
- Conditions:
  ses:ApiVersion
  
  ses:FeedbackAddress
  
  ses:FromAddress
  
  ses:FromDisplayName
  
  ses:Recipients
SendEmail
- Description: Grants permission to send an email message
- Access: Write
- Resources:
  Name: identity
  
  Required: Yes
  
  Name: configuration-set
  
  Required: No
- Conditions:
  ses:ApiVersion
  
  ses:FeedbackAddress
  
  ses:FromAddress
  
  ses:FromDisplayName
  
  ses:Recipients
SendRawEmail
- Description: Grants permission to send an email message, with header and content specified by the client
- Access: Write
- Resources:
  Name: identity
  
  Required: Yes
  
  Name: configuration-set
  
  Required: No
- Conditions:
  ses:ApiVersion
  
  ses:FeedbackAddress
  
  ses:FromAddress
  
  ses:FromDisplayName
  
  ses:Recipients
SendTemplatedEmail
- Description: Grants permission to compose an email message using an email template
- Access: Write
- Resources:
  Name: identity
  
  Required: Yes
  
  Name: template
  
  Required: Yes
  
  Name: configuration-set
  
  Required: No
- Conditions:
  ses:ApiVersion
  
  ses:FeedbackAddress
  
  ses:FromAddress
  
  ses:FromDisplayName
  
  ses:Recipients
SetActiveReceiptRuleSet
- Description: Grants permission to set the specified receipt rule set as the active receipt rule set
- Access: Write
- Conditions:
  ses:ApiVersion
SetIdentityDkimEnabled
- Description: Grants permission to enable or disable Easy DKIM signing of email sent from an identity
- Access: Write
- Conditions:
  ses:ApiVersion
SetIdentityFeedbackForwardingEnabled
- Description: Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain)
- Access: Write
- Conditions:
  ses:ApiVersion
SetIdentityHeadersInNotificationsEnabled
- Description: Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain)
- Access: Write
- Conditions:
  ses:ApiVersion
SetIdentityMailFromDomain
- Description: Grants permission to enable or disable the custom MAIL FROM domain setup for a verified identity
- Access: Write
- Conditions:
  ses:ApiVersion
SetIdentityNotificationTopic
- Description: Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity
- Access: Write
- Conditions:
  ses:ApiVersion
SetReceiptRulePosition
- Description: Grants permission to set the position of the specified receipt rule in the receipt rule set
- Access: Write
- Conditions:
  ses:ApiVersion
TestRenderTemplate
- Description: Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateAccountSendingEnabled
- Description: Grants permission to enable or disable email sending for your account
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateConfigurationSetEventDestination
- Description: Grants permission to update the event destination of a configuration set
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateConfigurationSetReputationMetricsEnabled
- Description: Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateConfigurationSetSendingEnabled
- Description: Grants permission to enable or disable email sending for messages sent using a specific configuration set
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateConfigurationSetTrackingOptions
- Description: Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateCustomVerificationEmailTemplate
- Description: Grants permission to update an existing custom verification email template
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateReceiptRule
- Description: Grants permission to update a receipt rule
- Access: Write
- Conditions:
  ses:ApiVersion
UpdateTemplate
- Description: Grants permission to update an email template
- Access: Write
- Conditions:
  ses:ApiVersion
VerifyDomainDkim
- Description: Grants permission to return a set of DKIM tokens for a domain
- Access: Write
- Conditions:
  ses:ApiVersion
VerifyDomainIdentity
- Description: Grants permission to verify a domain
- Access: Write
- Conditions:
  ses:ApiVersion
VerifyEmailAddress
- Description: Grants permission to verify an email address
- Access: Write
- Conditions:
  ses:ApiVersion
VerifyEmailIdentity
- Description: Grants permission to verify an email identity
- Access: Write
- Conditions:
  ses:ApiVersion

Amazon Simple Email Service - Mail Manager (ses)

Additions

Updates

Deletions