---
title: Getting Started with Datadog
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog
---

# aws_ses_rule_set{% #aws_ses_rule_set %}

## `account_id`{% #account_id %}

**Type**: `STRING`

## `created_date`{% #created_date %}

**Type**: `TIMESTAMP`**Provider name**: `CreatedDate`**Description**: The date of when then rule set was created.

## `last_modification_date`{% #last_modification_date %}

**Type**: `TIMESTAMP`**Provider name**: `LastModificationDate`**Description**: The date of when the rule set was last modified.

## `rule_set_arn`{% #rule_set_arn %}

**Type**: `STRING`**Provider name**: `RuleSetArn`**Description**: The Amazon Resource Name (ARN) of the rule set resource.

## `rule_set_id`{% #rule_set_id %}

**Type**: `STRING`**Provider name**: `RuleSetId`**Description**: The identifier of the rule set resource.

## `rule_set_name`{% #rule_set_name %}

**Type**: `STRING`**Provider name**: `RuleSetName`**Description**: A user-friendly name for the rule set resource.

## `rules`{% #rules %}

**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Rules`**Description**: The rules contained in the rule set.

- `actions`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Actions`**Description**: The list of actions to execute when the conditions match the incoming email, and none of the "unless conditions" match.
  - `add_header`**Type**: `STRUCT`**Provider name**: `AddHeader`**Description**: This action adds a header. This can be used to add arbitrary email headers.

    - `header_name`**Type**: `STRING`**Provider name**: `HeaderName`**Description**: The name of the header to add to an email. The header must be prefixed with "X-". Headers are added regardless of whether the header name pre-existed in the email.
    - `header_value`**Type**: `STRING`**Provider name**: `HeaderValue`**Description**: The value of the header to add to the email.

  - `archive`**Type**: `STRUCT`**Provider name**: `Archive`**Description**: This action archives the email. This can be used to deliver an email to an archive.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified archive has been deleted.
    - `target_archive`**Type**: `STRING`**Provider name**: `TargetArchive`**Description**: The identifier of the archive to send the email to.

  - `deliver_to_mailbox`**Type**: `STRUCT`**Provider name**: `DeliverToMailbox`**Description**: This action delivers an email to a WorkMail mailbox.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the mailbox ARN is no longer valid.
    - `mailbox_arn`**Type**: `STRING`**Provider name**: `MailboxArn`**Description**: The Amazon Resource Name (ARN) of a WorkMail organization to deliver the email to.
    - `role_arn`**Type**: `STRING`**Provider name**: `RoleArn`**Description**: The Amazon Resource Name (ARN) of an IAM role to use to execute this action. The role must have access to the workmail:DeliverToMailbox API.

  - `deliver_to_q_business`**Type**: `STRUCT`**Provider name**: `DeliverToQBusiness`**Description**: This action delivers an email to an Amazon Q Business application for ingestion into its knowledge base.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified application has been deleted or the role lacks necessary permissions to call the qbusiness:BatchPutDocument API.
    - `application_id`**Type**: `STRING`**Provider name**: `ApplicationId`**Description**: The unique identifier of the Amazon Q Business application instance where the email content will be delivered.
    - `index_id`**Type**: `STRING`**Provider name**: `IndexId`**Description**: The identifier of the knowledge base index within the Amazon Q Business application where the email content will be stored and indexed.
    - `role_arn`**Type**: `STRING`**Provider name**: `RoleArn`**Description**: The Amazon Resource Name (ARN) of the IAM Role to use while delivering to Amazon Q Business. This role must have access to the qbusiness:BatchPutDocument API for the given application and index.

  - `drop`**Type**: `STRUCT`**Provider name**: `Drop`**Description**: This action terminates the evaluation of rules in the rule set.

  - `relay`**Type**: `STRUCT`**Provider name**: `Relay`**Description**: This action relays the email to another SMTP server.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified relay has been deleted.
    - `mail_from`**Type**: `STRING`**Provider name**: `MailFrom`**Description**: This action specifies whether to preserve or replace original mail from address while relaying received emails to a destination server.
    - `relay`**Type**: `STRING`**Provider name**: `Relay`**Description**: The identifier of the relay resource to be used when relaying an email.

  - `replace_recipient`**Type**: `STRUCT`**Provider name**: `ReplaceRecipient`**Description**: The action replaces certain or all recipients with a different set of recipients.

    - `replace_with`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `ReplaceWith`**Description**: This action specifies the replacement recipient email addresses to insert.

  - `send`**Type**: `STRUCT`**Provider name**: `Send`**Description**: This action sends the email to the internet.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the caller does not have the permissions to call the sendRawEmail API.
    - `role_arn`**Type**: `STRING`**Provider name**: `RoleArn`**Description**: The Amazon Resource Name (ARN) of the role to use for this action. This role must have access to the ses:SendRawEmail API.

  - `write_to_s3`**Type**: `STRUCT`**Provider name**: `WriteToS3`**Description**: This action writes the MIME content of the email to an S3 bucket.

    - `action_failure_policy`**Type**: `STRING`**Provider name**: `ActionFailurePolicy`**Description**: A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified the bucket has been deleted.
    - `role_arn`**Type**: `STRING`**Provider name**: `RoleArn`**Description**: The Amazon Resource Name (ARN) of the IAM Role to use while writing to S3. This role must have access to the s3:PutObject, kms:Encrypt, and kms:GenerateDataKey APIs for the given bucket.
    - `s3_bucket`**Type**: `STRING`**Provider name**: `S3Bucket`**Description**: The bucket name of the S3 bucket to write to.
    - `s3_prefix`**Type**: `STRING`**Provider name**: `S3Prefix`**Description**: The S3 prefix to use for the write to the s3 bucket.
    - `s3_sse_kms_key_id`**Type**: `STRING`**Provider name**: `S3SseKmsKeyId`**Description**: The KMS Key ID to use to encrypt the message in S3.
- `conditions`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Conditions`**Description**: The conditions of this rule. All conditions must match the email for the actions to be executed. An empty list of conditions means that all emails match, but are still subject to any "unless conditions"
  - `boolean_expression`**Type**: `STRUCT`**Provider name**: `BooleanExpression`**Description**: The condition applies to a boolean expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The operand on which to perform a boolean condition operation.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The boolean type representing the allowed attribute types for an email.
      - `is_in_address_list`**Type**: `STRUCT`**Provider name**: `IsInAddressList`**Description**: The structure representing the address lists and address list attribute that will be used in evaluation of boolean expression.
        - `address_lists`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `AddressLists`**Description**: The address lists that will be used for evaluation.
        - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email attribute that needs to be evaluated against the address list.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a boolean condition expression.
  - `dmarc_expression`**Type**: `STRUCT`**Provider name**: `DmarcExpression`**Description**: The condition applies to a DMARC policy expression passed in this field.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator to apply to the DMARC policy of the incoming email.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The values to use for the given DMARC policy operator. For the operator EQUALS, if multiple values are given, they are evaluated as an OR. That is, if any of the given values match, the condition is deemed to match. For the operator NOT_EQUALS, if multiple values are given, they are evaluated as an AND. That is, only if the email's DMARC policy is not equal to any of the given values, then the condition is deemed to match.
  - `ip_expression`**Type**: `STRUCT`**Provider name**: `IpExpression`**Description**: The condition applies to an IP address expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The IP address to evaluate in this condition.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The attribute of the email to evaluate.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator to evaluate the IP address.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The IP CIDR blocks in format "x.y.z.w/n" (eg 10.0.0.0/8) to match with the email's IP address. For the operator CIDR_MATCHES, if multiple values are given, they are evaluated as an OR. That is, if the IP address is contained within any of the given CIDR ranges, the condition is deemed to match. For NOT_CIDR_MATCHES, if multiple CIDR ranges are given, the condition is deemed to match if the IP address is not contained in any of the given CIDR ranges.
  - `number_expression`**Type**: `STRUCT`**Provider name**: `NumberExpression`**Description**: The condition applies to a number expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The number to evaluate in a numeric condition expression.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: An email attribute that is used as the number to evaluate.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator for a numeric condition expression.
    - `value`**Type**: `DOUBLE`**Provider name**: `Value`**Description**: The value to evaluate in a numeric condition expression.
  - `string_expression`**Type**: `STRUCT`**Provider name**: `StringExpression`**Description**: The condition applies to a string expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The string to evaluate in a string condition expression.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email attribute to evaluate in a string condition expression.
      - `mime_header_attribute`**Type**: `STRING`**Provider name**: `MimeHeaderAttribute`**Description**: The email MIME X-Header attribute to evaluate in a string condition expression.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a string condition expression.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The string(s) to be evaluated in a string condition expression. For all operators, except for NOT_EQUALS, if multiple values are given, the values are processed as an OR. That is, if any of the values match the email's string using the given operator, the condition is deemed to match. However, for NOT_EQUALS, the condition is only deemed to match if none of the given strings match the email's string.
  - `verdict_expression`**Type**: `STRUCT`**Provider name**: `VerdictExpression`**Description**: The condition applies to a verdict expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The verdict to evaluate in a verdict condition expression.
      - `analysis`**Type**: `STRUCT`**Provider name**: `Analysis`**Description**: The Add On ARN and its returned value to evaluate in a verdict condition expression.
        - `analyzer`**Type**: `STRING`**Provider name**: `Analyzer`**Description**: The Amazon Resource Name (ARN) of an Add On.
        - `result_field`**Type**: `STRING`**Provider name**: `ResultField`**Description**: The returned value from an Add On.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email verdict attribute to evaluate in a string verdict expression.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a verdict condition expression.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The values to match with the email's verdict using the given operator. For the EQUALS operator, if multiple values are given, the condition is deemed to match if any of the given verdicts match that of the email. For the NOT_EQUALS operator, if multiple values are given, the condition is deemed to match of none of the given verdicts match the verdict of the email.
- `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The user-friendly name of the rule.
- `unless`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Unless`**Description**: The "unless conditions" of this rule. None of the conditions can match the email for the actions to be executed. If any of these conditions do match the email, then the actions are not executed.
  - `boolean_expression`**Type**: `STRUCT`**Provider name**: `BooleanExpression`**Description**: The condition applies to a boolean expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The operand on which to perform a boolean condition operation.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The boolean type representing the allowed attribute types for an email.
      - `is_in_address_list`**Type**: `STRUCT`**Provider name**: `IsInAddressList`**Description**: The structure representing the address lists and address list attribute that will be used in evaluation of boolean expression.
        - `address_lists`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `AddressLists`**Description**: The address lists that will be used for evaluation.
        - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email attribute that needs to be evaluated against the address list.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a boolean condition expression.
  - `dmarc_expression`**Type**: `STRUCT`**Provider name**: `DmarcExpression`**Description**: The condition applies to a DMARC policy expression passed in this field.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator to apply to the DMARC policy of the incoming email.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The values to use for the given DMARC policy operator. For the operator EQUALS, if multiple values are given, they are evaluated as an OR. That is, if any of the given values match, the condition is deemed to match. For the operator NOT_EQUALS, if multiple values are given, they are evaluated as an AND. That is, only if the email's DMARC policy is not equal to any of the given values, then the condition is deemed to match.
  - `ip_expression`**Type**: `STRUCT`**Provider name**: `IpExpression`**Description**: The condition applies to an IP address expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The IP address to evaluate in this condition.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The attribute of the email to evaluate.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator to evaluate the IP address.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The IP CIDR blocks in format "x.y.z.w/n" (eg 10.0.0.0/8) to match with the email's IP address. For the operator CIDR_MATCHES, if multiple values are given, they are evaluated as an OR. That is, if the IP address is contained within any of the given CIDR ranges, the condition is deemed to match. For NOT_CIDR_MATCHES, if multiple CIDR ranges are given, the condition is deemed to match if the IP address is not contained in any of the given CIDR ranges.
  - `number_expression`**Type**: `STRUCT`**Provider name**: `NumberExpression`**Description**: The condition applies to a number expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The number to evaluate in a numeric condition expression.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: An email attribute that is used as the number to evaluate.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The operator for a numeric condition expression.
    - `value`**Type**: `DOUBLE`**Provider name**: `Value`**Description**: The value to evaluate in a numeric condition expression.
  - `string_expression`**Type**: `STRUCT`**Provider name**: `StringExpression`**Description**: The condition applies to a string expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The string to evaluate in a string condition expression.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email attribute to evaluate in a string condition expression.
      - `mime_header_attribute`**Type**: `STRING`**Provider name**: `MimeHeaderAttribute`**Description**: The email MIME X-Header attribute to evaluate in a string condition expression.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a string condition expression.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The string(s) to be evaluated in a string condition expression. For all operators, except for NOT_EQUALS, if multiple values are given, the values are processed as an OR. That is, if any of the values match the email's string using the given operator, the condition is deemed to match. However, for NOT_EQUALS, the condition is only deemed to match if none of the given strings match the email's string.
  - `verdict_expression`**Type**: `STRUCT`**Provider name**: `VerdictExpression`**Description**: The condition applies to a verdict expression passed in this field.
    - `evaluate`**Type**: `STRUCT`**Provider name**: `Evaluate`**Description**: The verdict to evaluate in a verdict condition expression.
      - `analysis`**Type**: `STRUCT`**Provider name**: `Analysis`**Description**: The Add On ARN and its returned value to evaluate in a verdict condition expression.
        - `analyzer`**Type**: `STRING`**Provider name**: `Analyzer`**Description**: The Amazon Resource Name (ARN) of an Add On.
        - `result_field`**Type**: `STRING`**Provider name**: `ResultField`**Description**: The returned value from an Add On.
      - `attribute`**Type**: `STRING`**Provider name**: `Attribute`**Description**: The email verdict attribute to evaluate in a string verdict expression.
    - `operator`**Type**: `STRING`**Provider name**: `Operator`**Description**: The matching operator for a verdict condition expression.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The values to match with the email's verdict using the given operator. For the EQUALS operator, if multiple values are given, the condition is deemed to match if any of the given verdicts match that of the email. For the NOT_EQUALS operator, if multiple values are given, the condition is deemed to match of none of the given verdicts match the verdict of the email.

## `tags`{% #tags %}

**Type**: `UNORDERED_LIST_STRING`