SES Identity Unverified / Unusable
What does ZopNight detect here?
SES email identities stuck in a terminal verification state, either FAILED or NOT_STARTED, are dead configuration that can never send mail. ZopNight fires on exactly those 2 terminal states, abstains on transient PENDING and TEMPORARY_FAILURE (mid-onboarding identities AWS is still verifying), and remediates by calling sesv2 DeleteEmailIdentity.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1526 |
| Category | advisory |
| Severity | low |
| Metric | none — pure configuration read |
| Source | ses_idle.go |
Where it applies
Why verification status replaced send counts
the original v1 contract gated on a per-identity sends=0 signal, but that contract is physically un-honorable, because the only native SES activity metric, AWS/SES Send / Delivery (CloudWatch), is published at the or per ses:configuration-set, never per email identity (see backend/aggregator/docs/METRICS.md §SES). Emitting a per-resource sends=0 from that metric would fabricate a measured-zero claim. The rule is re-keyed onto verification_status, a real signal harvested by the dedicated SESProvider (sesv2 ListEmailIdentities) and stamped onto resource.Metadata, with UID convention ses-identity/<region>/<name>. Only the terminal non-verified states fire (FAILED, NOT_STARTED): dead configuration to complete or delete. The transient states abstain (2026-07-05, third-batch remark): PENDING is the routine DNS-propagation window after identity creation and TEMPORARY_FAILURE means AWS is still retrying a previously-successful verification. Since the remediation deletes the identity, firing there would advise destroying a mid-onboarding identity. Evaluate also fails closed (abstains) when verification_status is absent from Metadata. the provisioner Deleter (backend/provisioner/internal/remediation/delete/aws/ses.go) parses the identity name out of the ses-identity/<region>/<name> UID and calls sesv2.DeleteEmailIdentity(EmailIdentity: <name>). Required IAM: ses:DeleteEmailIdentity. Idempotent on NotFoundException. GuidedReviewInput (guided_review.go) now describes the action the executor actually performs: deleting the verified email identity (the sending address or domain itself), after which every message from that address/domain is rejected until it is re-verified (re-publishing DNS records for a domain). It previously claimed to delete only an idle SES “configuration set” and its per-set event tracking, leaving verified senders “unaffected”, which is the wrong resource and severity for a DeleteEmailIdentity call. The preview items and EducateCopy are updated to high severit