TLS not enforced in SES configuration set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_365
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule checks whether the Simple Email Service (SES) Configuration configured in AWS enforces Transport Layer Security (TLS). TLS plays a crucial role in safeguarding the confidentiality and integrity of transmitted data, especially in emails. Not enforcing TLS can potentially expose data to risks such as interception and manipulation.

How to Fix

Resource: aws_ses_configuration_set

• Arguments: delivery_options.tls_policy

To fix this issue, modify your AWS Simple Email Service (SES) configurations to ensure the enforcement of Transport Layer Security (TLS) usage.

The revised Terraform code above implements TLS enforcement in the SES configuration set, guaranteeing secure transmission for all outgoing emails. By setting tls_policy to "Require", AWS SES will only deliver emails through connections encrypted with TLS. Any attempt to deliver emails over unencrypted SSL/TLS connections will be rejected. [source,go]

resource "aws_ses_configuration_set" "example" { ...

delivery_options { tls_policy = "Require" } }