Wrong policy action when create an AwsCustomResource

Hello, When I try to create the AwsCustomResource show as example in the documentation : https://docs.aws.amazon.com/cdk/api/latest/docs/custom-resources-readme.html, I got a cloudformation error.

Reproduction Steps

import { AwsCustomResource } from "@aws-cdk/custom-resources";
const app = new App();
const verifyDomainIdentity = new AwsCustomResource(app, 'VerifyDomainIdentity', {
  onCreate: {
    service: 'SES',
    action: 'verifyDomainIdentity',
    parameters: {
      Domain: 'example.com'
    },
    physicalResourceIdPath: 'VerificationToken' // Use the token returned by the call as physical id
  }
});

Error Log

Failed to create resource. User: arn:aws:sts::***:assumed-role/***-***/***-***-*** is not authorized to perform: ses:VerifyDomainIdentity

Environment

• CLI Version : 1.13.0 (build 250a270)
• Framework Version: 1.13.0
• OS : Debian
• Language : javascript

Other

When I look the cloudformation created by cdk, the Action property is wrong. I got ``“Action”: “email:VerifyDomainIdentity"instead of"Action”: “ses:VerifyDomainIdentity”`

I think mapping define here is not correct for all services.

Workaround

import { AwsCustomResource } from "@aws-cdk/custom-resources";
const app = new App();
const verifyDomainIdentity = new AwsCustomResource(app, 'VerifyDomainIdentity', {
  onCreate: {
    service: 'SES',
    action: 'verifyDomainIdentity',
    parameters: {
      Domain: 'example.com'
    },
    physicalResourceIdPath: 'VerificationToken' // Use the token returned by the call as physical id
  },
  policyStatements : [
    new PolicyStatement({
      resources : ['*'],
      actions   : ['ses:VerifyDomainIdentity'],
    }),
  ],
});

---

This is 🐛 Bug Report

[NGL321]

Escalating to p1 as this has been pending and blocking for too long

[juliagrigni]

I’m not sure if this is an issue people are still struggling with, but here’s a potential workaround I found (I did not write it) that works for me:

Create a policy with the action as it should be in IAM (ex: ‘ses:verifyEmailIdentity’), then attach that policy to your custom resource, instead of having it create the policy using fromSdkCalls.

I’m sorry if this was already common knowledge/unhelpful, but I hope it’s helpful to someone as a workaround in the meantime!