I have having issue with S3 configuration creating SES email receiving workflow using cloudformation on my Amplify Project. I have attached the cloudformation file below and the error as well.

The error you're encountering suggests that there's an issue with the S3 configuration in your CloudFormation template for the SES email receiving workflow. The specific error indicates that SES could not write to the specified S3 bucket. This could be due to a few reasons:

1. Permissions: The S3 bucket policy might not be correctly configured to allow SES to write to the bucket.

2. Bucket Name: There might be a mismatch between the bucket name specified in the CloudFormation template and the actual bucket name.

3. Bucket Existence: The S3 bucket might not exist at the time SES is trying to write to it.

To resolve this issue, you can try the following:

1. Double-check the S3 bucket policy in your CloudFormation template. Ensure that it grants the necessary permissions for SES to write to the bucket.

2. Verify that the bucket name in the CatchAllReceiptRule resource matches the bucket name defined in the EmailInvoicesBucket resource. Make sure you're using the correct environment variable interpolation.

3. Ensure that the S3 bucket is created before the SES receipt rule tries to use it. You can do this by adding a DependsOn attribute to the CatchAllReceiptRule resource that references the EmailInvoicesBucket.

4. Check if there are any naming conflicts or if the bucket name is already taken. S3 bucket names must be globally unique.

5. Verify that your AWS account has the necessary permissions to create and manage S3 buckets and SES receipt rules.

If the issue persists after these checks, you may need to review the CloudFormation stack events or CloudWatch logs for more detailed error messages to pinpoint the exact cause of the problem.
Sources
Troubleshoot CloudFormation module errors | AWS re:Post
AWS::CloudFormation::ResourceVersion - AWS CloudFormation
AWS::CloudFormation::HookVersion - AWS CloudFormation

Hello there.

The error message you've received suggests that the S3 bucket you're referencing in your CloudFormation template does not exist.

1. Environment Variable Mismatch: In your CloudFormation template, you're using a dynamic bucket name that includes the environment (email-invoices-bucket-${env}). Ensure that:

   • The env parameter is correctly set
   • The actual bucket name matches exactly what you're referencing in your template

2. Bucket Creation Timing: I have checked the bucket and it creates first therefore bucket timing is not an issue here.

Looking at your template and made few minor changes:

The key changes made

1. In the EmailInvoicesBucketPolicy, you will need to use !Ref EmailInvoicesBucket instead of constructing the bucket name manually.
2. In the CatchAllReceiptRule, you will need to use !Ref EmailInvoicesBucket for the S3Action's BucketName.

Please note that these changes ensure that the bucket reference is consistent and uses the correct logical reference from the EmailInvoicesBucket resource.

Make sure when you deploy this template that you provide a value for the env parameter, which will be used to create the bucket name if ShouldNotCreateEnvResources is false.

The Template I made minor template:

AWSTemplateFormatVersion: '2010-09-09' Parameters: env: Type: String Description: Current Amplify CLI env name Conditions: ShouldNotCreateEnvResources: !Equals - !Ref env - NONE Resources: EmailInvoicesBucket: Type: AWS::S3::Bucket Properties: BucketName: !If - ShouldNotCreateEnvResources - email-invoices-bucket - !Join - '' - - email-invoices-bucket - '-' - !Ref env UpdateReplacePolicy: Retain DeletionPolicy: Retain EmailInvoicesBucketPolicy: Type: AWS::S3::BucketPolicy DependsOn: EmailInvoicesBucket Properties: Bucket: !Ref EmailInvoicesBucket PolicyDocument: Statement: - Action: s3:PutObject Condition: StringEquals: aws:SourceAccount: !Ref 'AWS::AccountId' aws:SourceArn: 'arn:aws:ses:${AWS::Region}:${AWS::AccountId}:receipt-rule-set/EmailProcessingRuleSet:receipt-rule/' Effect: Allow Principal: Service: ses.amazonaws.com Resource: !Join - '' - - !GetAtt EmailInvoicesBucket.Arn - '/' Version: '2012-10-17' snstopic: Type: AWS::SNS::Topic Properties: TopicName: !If - ShouldNotCreateEnvResources - email-invoices-topic - !Join - '' - - email-invoices-topic - '-' - !Ref env snstopicPolicy: Type: AWS::SNS::TopicPolicy DependsOn: snstopic Properties: PolicyDocument: Statement: - Action: sns:Publish Condition: StringEquals: aws:SourceAccount: !Ref 'AWS::AccountId' aws:SourceArn: 'arn:aws:ses:${AWS::Region}:${AWS::AccountId}:receipt-rule-set/EmailProcessingRuleSet:receipt-rule/*' Effect: Allow Principal: Service: ses.amazonaws.com Resource: !Ref snstopic Sid: '0' Version: '2012-10-17' Topics: - !Ref snstopic ReceiptRuleSet: Type: AWS::SES::ReceiptRuleSet Properties: RuleSetName: EmailProcessingRuleSet CatchAllReceiptRule: DependsOn: - EmailInvoicesBucket - snstopic - ReceiptRuleSet Type: AWS::SES::ReceiptRule Properties: Rule: Actions: - S3Action: BucketName: !Ref EmailInvoicesBucket ObjectKeyPrefix: emails/ - SNSAction: Encoding: UTF-8 TopicArn: !Ref snstopic Enabled: true Name: !If - ShouldNotCreateEnvResources - CatchAllRule - !Join - '' - - CatchAllRule - '-' - !Ref env Recipients: - example.xyz - .example.xyz ScanEnabled: true RuleSetName: EmailProcessingRuleSet

Above information is for this error:

"No such bucket: email-invoices-bucket (Service: null; Status Code: 400; Error Code: InvalidS3Configuration; Request ID: 87cfd0e4-118c-42a5-8599-fdabd6c896e4; Proxy: null)"

Now for this error "CatchAllReceiptRule (AWS::SES::ReceiptRule), Event Type: create, Reason: Could not write to bucket: email-invoices-bucket-niuralpayroll-prabhatenv (Service: null; Status Code: 400; Error Code: InvalidS3Configuration; Request ID: 17fb5d86-6506-4a9d-957d-21d6d965ec15; Proxy: null), IsCustomResource: true":

It suggests an S3 bucket configuration issue. The most likely cause is the SES service not having proper permissions to write to the bucket.

Please try adding correct permissions to the bucket policy "EmailInvoicesBucketPolicy"

PolicyDocument: Version: '2012-10-17' Statement: - Sid: AllowSESPutObject Effect: Allow Principal: Service: ses.amazonaws.com Action: - s3:PutObject Resource: !Sub ${EmailInvoicesBucket.Arn}/*