Error when creating SES Rule with s3 action from existing rule set

[hanstf]

🐛 Bug Report

What is the problem?

Unable to create SES Rule with s3 action from existing rule set.

Reproduction Steps

I am trying to create a SES Rule from an existing rule set which actions are to s3 bucket and sns topic as shown below.

        const ruleSet = ReceiptRuleSet.fromReceiptRuleSetName(this, 'RuleSet', props.ruleSetName);
const emailTopic = new Topic(this, 'Topic', {
            displayName: 'Email Scrapper'
        });
        const emailBucket = new Bucket(this, 'Bucket');
        ruleSet.addRule(
            'Rules',
            {
                recipients: ['reflaunt.email'],
                actions: [
                    new ReceiptRuleS3Action({
                        bucket: emailBucket,
                        topic: emailTopic
                    })
                ]
            }
        );

But everytime I deploy, I always receive this error

Could not write to bucket: emailscrapperstack-dev-emailscrapperobjectobjectb-1xx3t61zt8bxb (Service: AmazonSimpleEmailService; Status Code: 400; Error Code: InvalidS3Configuration; Request ID: faff6bc9-e2ae-4c34-863c-39d3b59f23d1)

Then I realized that the s3 bucket policy was not configured when the rule is added, so for now I did a hacky-fix by adding s3 resource policy dependency to the rule set.

        const cfnBucketPolicy = emailBucket.node.findChild("Policy").node.findChild("Resource") as CfnBucketPolicy;
        ruleSet.node.addDependency(cfnBucketPolicy);

Is there any better way to achieve this ?
Also the strange thing is, I don't have the issue with the sns topic, even the rule set is not depending on the sns policy.

Verbose Log

Could not write to bucket: emailscrapperstack-dev-emailscrapperobjectobjectb-1xx3t61zt8bxb (Service: AmazonSimpleEmailService; Status Code: 400; Error Code: InvalidS3Configuration; Request ID: faff6bc9-e2ae-4c34-863c-39d3b59f23d1)

Environment

• CDK CLI Version: 1.4.0
• Module Version: 1.4.0
• OS: ubuntu 18.04
• Language: TypeScript

Other information

[jogold]

There is indeed a race condition here that can only be solved with a CF DependsOn.

With the current implementation of ReceiptRuleS3Action it's not that easy to solve this.

I would say that anyway those receipt rule actions should be refactored as integrations and moved to another package (aws-ses-actions/aws-ses-receipt-actions?), same pattern as aws-events-targets, aws-sns-subscriptions... @rix0rrr?

[hanstf]

Yes it is quite confusing to addDependency from the ruleset resource itself as the declaration in cf is only for the action.