Security Perimeter

The security perimeter constructs harden the edge of your app: a WAF WebACL in front of the API, and SES identities for outbound email. Both associate to other resources through SSM, never CloudFormation exports.

WAF — AtfWaf

A REGIONAL WebACL associated to your REST API stage (or AppSync API) via the stage ARN the API stack writes to SSM. example-rest-full associates the WebACL to the REST stage ARN; example-graphql-full associates it to the main AppSync API ARN. This keeps the WebACL in its own SecurityStack, decoupled from the API stack’s lifecycle.

SES — AtfSes

Domain identities plus a configuration set (reputation metrics). SES starts in the sandbox until AWS grants production access — you can only send to verified identities until then. The framework surfaces DKIM CNAME tokens via CfnOutput for manual DNS when no hostedZoneId is wired; the examples are synth-only and perform no live send.

Why a separate SecurityStack

Keeping WAF and SES in a SecurityStack (rather than the API stack) means the WebACL association reads the API stage ARN from SSM — the two stacks deploy and change independently. That is the SSM-only cross-stack rule doing its job.

Where to go next

• AtfWaf and AtfSes for the construct props.
• Stacks & SSM Wiring for the association pattern.