create-rule-set

  create-rule-set
[--client-token <value>]
--rule-set-name <value>
--rules <value>
[--tags <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

[
  {
    "Actions": [
      {
        "AddHeader": {
          "HeaderName": "string",
          "HeaderValue": "string"
        },
        "Archive": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "TargetArchive": "string"
        },
        "DeliverToMailbox": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "MailboxArn": "string",
          "RoleArn": "string"
        },
        "DeliverToQBusiness": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "ApplicationId": "string",
          "IndexId": "string",
          "RoleArn": "string"
        },
        "Drop": {

        },
        "PublishToSns": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "Encoding": "UTF-8"|"BASE64",
          "PayloadType": "HEADERS"|"CONTENT",
          "RoleArn": "string",
          "TopicArn": "string"
        },
        "Relay": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "MailFrom": "REPLACE"|"PRESERVE",
          "Relay": "string"
        },
        "ReplaceRecipient": {
          "ReplaceWith": ["string", ...]
        },
        "Send": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "RoleArn": "string"
        },
        "WriteToS3": {
          "ActionFailurePolicy": "CONTINUE"|"DROP",
          "RoleArn": "string",
          "S3Bucket": "string",
          "S3Prefix": "string",
          "S3SseKmsKeyId": "string"
        }
      }
      ...
    ],
    "Conditions": [
      {
        "BooleanExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "READ_RECEIPT_REQUESTED"|"TLS"|"TLS_WRAPPED",
            "IsInAddressList": {
              "AddressLists": ["string", ...],
              "Attribute": "RECIPIENT"|"MAIL_FROM"|"SENDER"|"FROM"|"TO"|"CC"
            }
          },
          "Operator": "IS_TRUE"|"IS_FALSE"
        },
        "DmarcExpression": {
          "Operator": "EQUALS"|"NOT_EQUALS",
          "Values": ["NONE"|"QUARANTINE"|"REJECT", ...]
        },
        "IpExpression": {
          "Evaluate": {
            "Attribute": "SOURCE_IP"
          },
          "Operator": "CIDR_MATCHES"|"NOT_CIDR_MATCHES",
          "Values": ["string", ...]
        },
        "NumberExpression": {
          "Evaluate": {
            "Attribute": "MESSAGE_SIZE"
          },
          "Operator": "EQUALS"|"NOT_EQUALS"|"LESS_THAN"|"GREATER_THAN"|"LESS_THAN_OR_EQUAL"|"GREATER_THAN_OR_EQUAL",
          "Value": double
        },
        "StringExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "MAIL_FROM"|"HELO"|"RECIPIENT"|"SENDER"|"FROM"|"SUBJECT"|"TO"|"CC",
            "MimeHeaderAttribute": "string"
          },
          "Operator": "EQUALS"|"NOT_EQUALS"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS",
          "Values": ["string", ...]
        },
        "VerdictExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "SPF"|"DKIM"
          },
          "Operator": "EQUALS"|"NOT_EQUALS",
          "Values": ["PASS"|"FAIL"|"GRAY"|"PROCESSING_FAILED", ...]
        }
      }
      ...
    ],
    "Name": "string",
    "Unless": [
      {
        "BooleanExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "READ_RECEIPT_REQUESTED"|"TLS"|"TLS_WRAPPED",
            "IsInAddressList": {
              "AddressLists": ["string", ...],
              "Attribute": "RECIPIENT"|"MAIL_FROM"|"SENDER"|"FROM"|"TO"|"CC"
            }
          },
          "Operator": "IS_TRUE"|"IS_FALSE"
        },
        "DmarcExpression": {
          "Operator": "EQUALS"|"NOT_EQUALS",
          "Values": ["NONE"|"QUARANTINE"|"REJECT", ...]
        },
        "IpExpression": {
          "Evaluate": {
            "Attribute": "SOURCE_IP"
          },
          "Operator": "CIDR_MATCHES"|"NOT_CIDR_MATCHES",
          "Values": ["string", ...]
        },
        "NumberExpression": {
          "Evaluate": {
            "Attribute": "MESSAGE_SIZE"
          },
          "Operator": "EQUALS"|"NOT_EQUALS"|"LESS_THAN"|"GREATER_THAN"|"LESS_THAN_OR_EQUAL"|"GREATER_THAN_OR_EQUAL",
          "Value": double
        },
        "StringExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "MAIL_FROM"|"HELO"|"RECIPIENT"|"SENDER"|"FROM"|"SUBJECT"|"TO"|"CC",
            "MimeHeaderAttribute": "string"
          },
          "Operator": "EQUALS"|"NOT_EQUALS"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS",
          "Values": ["string", ...]
        },
        "VerdictExpression": {
          "Evaluate": {
            "Analysis": {
              "Analyzer": "string",
              "ResultField": "string"
            },
            "Attribute": "SPF"|"DKIM"
          },
          "Operator": "EQUALS"|"NOT_EQUALS",
          "Values": ["PASS"|"FAIL"|"GRAY"|"PROCESSING_FAILED", ...]
        }
      }
      ...
    ]
  }
  ...
]

Key=string,Value=string ...

[
  {
    "Key": "string",
    "Value": "string"
  }
  ...
]