Merge branch 'main' into fix/ecs-updateservice-fields

Author: vieiralucas

crates/fakecloud-cloudformation/src/resource_provisioner/ses.rs

@@ -314,6 +314,9 @@ impl ResourceProvisioner {
             mail_from_behavior_on_mx_failure: mail_from_behavior,
             mail_from_domain_status: "Success".to_string(),
             configuration_set_name,
+            bounce_topic: None,
+            complaint_topic: None,
+            delivery_topic: None,
         };
         let mut accounts = self.ses_state.write();
         let state = accounts.get_or_create(&self.account_id);

crates/fakecloud-secretsmanager/src/service.rs

@@ -1570,7 +1570,19 @@ impl SecretsManagerService {
                                     "CreatedDate": version.created_at.timestamp_millis() as f64 / 1000.0,
                                 });
                                 if let Some(ref s) = version.secret_string {
-                                    entry["SecretString"] = json!(s);
+                                    // Decrypt the same way GetSecretValue does;
+                                    // pushing the raw stored value leaked
+                                    // ciphertext when a KMS hook + KmsKeyId were
+                                    // configured (bug-audit 2026-06-20, 1.10).
+                                    let plaintext = self
+                                        .maybe_decrypt_secret_string(
+                                            &req.account_id,
+                                            &secret.arn,
+                                            secret.kms_key_id.as_deref(),
+                                            Some(s.as_str()),
+                                        )
+                                        .unwrap_or_else(|| s.clone());
+                                    entry["SecretString"] = json!(plaintext);
                                 }
                                 if let Some(ref b) = version.secret_binary {
                                     entry["SecretBinary"] = json!(base64_encode(b));
@@ -1647,7 +1659,17 @@ impl SecretsManagerService {
                             "CreatedDate": version.created_at.timestamp_millis() as f64 / 1000.0,
                         });
                         if let Some(ref s) = version.secret_string {
-                            entry["SecretString"] = json!(s);
+                            // Decrypt like GetSecretValue; the raw stored value
+                            // is ciphertext under a configured KMS hook (1.10).
+                            let plaintext = self
+                                .maybe_decrypt_secret_string(
+                                    &req.account_id,
+                                    &secret.arn,
+                                    secret.kms_key_id.as_deref(),
+                                    Some(s.as_str()),
+                                )
+                                .unwrap_or_else(|| s.clone());
+                            entry["SecretString"] = json!(plaintext);
                         }
                         if let Some(ref b) = version.secret_binary {
                             entry["SecretBinary"] = json!(base64_encode(b));

crates/fakecloud-secretsmanager/src/service_tests.rs

@@ -2295,3 +2295,66 @@ async fn snapshot_hook_fires_with_store() {
         .expect("hook present when a store is set");
     hook().await;
 }
+
+/// A KMS hook that "encrypts" by prefixing `ENC:` and "decrypts" by stripping
+/// it, so a test can prove a read path returns plaintext, not the stored
+/// ciphertext.
+struct PrefixKmsHook;
+impl fakecloud_core::delivery::KmsHook for PrefixKmsHook {
+    fn encrypt(
+        &self,
+        _account_id: &str,
+        _region: &str,
+        _key_id: &str,
+        plaintext: &[u8],
+        _service_principal: &str,
+        _ctx: std::collections::HashMap<String, String>,
+    ) -> Result<String, String> {
+        Ok(format!("ENC:{}", String::from_utf8_lossy(plaintext)))
+    }
+    fn decrypt(
+        &self,
+        _account_id: &str,
+        ciphertext_b64: &str,
+        _service_principal: &str,
+        _ctx: std::collections::HashMap<String, String>,
+    ) -> Result<Vec<u8>, String> {
+        Ok(ciphertext_b64
+            .strip_prefix("ENC:")
+            .unwrap_or(ciphertext_b64)
+            .as_bytes()
+            .to_vec())
+    }
+}
+
+#[tokio::test]
+async fn batch_get_secret_value_returns_plaintext_not_ciphertext() {
+    // GetSecretValue decrypts a KMS-backed secret, but BatchGetSecretValue
+    // pushed the raw stored ciphertext -- so a batch fetch returned an
+    // unusable encrypted blob (bug-audit 2026-06-20, 1.10).
+    let state = make_state();
+    let svc = SecretsManagerService::new(state).with_kms_hook(std::sync::Arc::new(PrefixKmsHook));
+
+    let req = make_request(
+        "CreateSecret",
+        r#"{"Name":"enc-secret","SecretString":"topsecret","KmsKeyId":"alias/test"}"#,
+    );
+    svc.handle(req).await.unwrap();
+
+    // Sanity: single-get decrypts.
+    let req = make_request("GetSecretValue", r#"{"SecretId":"enc-secret"}"#);
+    let single: Value =
+        serde_json::from_slice(svc.handle(req).await.unwrap().body.expect_bytes()).unwrap();
+    assert_eq!(single["SecretString"], "topsecret");
+
+    // The fix: batch must decrypt too.
+    let body = serde_json::json!({ "SecretIdList": ["enc-secret"] });
+    let req = make_request("BatchGetSecretValue", &body.to_string());
+    let batch: Value =
+        serde_json::from_slice(svc.handle(req).await.unwrap().body.expect_bytes()).unwrap();
+    let v = &batch["SecretValues"].as_array().unwrap()[0];
+    assert_eq!(
+        v["SecretString"], "topsecret",
+        "BatchGetSecretValue must return plaintext, not ciphertext"
+    );
+}