Repository navigation
fix(iac/aws): scope Fargate SES send to email_from_domain (match Lambda role, adversarial-review) - #1449
Conversation
The Fargate task role's SES policy granted ses:SendEmail and
ses:SendRawEmail on Resource="*" with no Condition, so a compromised ECS
task could spoof mail from any SES-verified identity in the account.
Split the single "SendFromAnyVerifiedIdentity" statement into two, to
mirror the Lambda module's existing defence-in-depth pattern:
- "SendFromCUDlyDomain": ses:SendEmail + ses:SendRawEmail on Resource="*"
gated by StringLike { "ses:FromAddress" = "*@${var.email_from_domain}" }
- "SESReadOnly": ses:GetAccount + ses:GetEmailIdentity on Resource="*"
(read-only; no send risk; no Condition required)
var.email_from_domain is already declared in the Fargate module's
variables.tf and used in the count guard, so no variable threading is
needed. Deployments with email_from_domain="" still receive zero SES
permissions.
terraform fmt and tflint both pass on the touched module.
Found via adversarial security review of IaC in origin/main.
cristim
added
triaged
|
@coderabbitai review |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 29 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅ Action performedReview finished.
|
Summary
aws_iam_role_policy.ses_accessin the Fargate module (SidSendFromAnyVerifiedIdentity) grantedses:SendEmailandses:SendRawEmailonResource = "*"with no Condition, allowing a compromised ECS task to send mail from any SES-verified identity in the account.SendFromCUDlyDomain- send actions gated byStringLike { "ses:FromAddress" = "*@${var.email_from_domain}" }SESReadOnly- read-only introspection actions (ses:GetAccount,ses:GetEmailIdentity) without a Condition (no sending capability)var.email_from_domainwas already declared in the Fargate module'svariables.tfand used in thecountguard, so no variable threading was required.Files changed
terraform/modules/compute/aws/fargate/main.tf- updated SES IAM policy and extended the block comment with the full blast-radius rationale (mirrors the Lambda module's comment).Verification
terraform fmt -checkclean on the touched module.tflintclean on the touched module.terraform validatenot run (provider cache not present in worktree); HCL syntax verified via fmt.Test plan
email_from_domainset; confirm email sending still works from the configured domain.email_from_domain = ""still attach zero SES permissions.Found via adversarial IaC security review of
origin/main.