fix(ses): drop spam rule appears in the incorrect order (#16146)

The auto-generated drop spam rule should come before all user-defined rules. If an email is classified as spam, it should stop the processing of all other rules.

Fixes #16091

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-ses/lib/receipt-rule-set.ts

@@ -109,12 +109,12 @@ export class ReceiptRuleSet extends ReceiptRuleSetBase {
     this.receiptRuleSetName = resource.ref;
 
     if (props) {
-      const rules = props.rules || [];
-      rules.forEach((ruleOption, idx) => this.addRule(`Rule${idx}`, ruleOption));
-
       if (props.dropSpam) {
         this.addDropSpamRule();
       }
+
+      const rules = props.rules || [];
+      rules.forEach((ruleOption, idx) => this.addRule(`Rule${idx}`, ruleOption));
     }
   }
 }

packages/@aws-cdk/aws-ses/test/test.receipt-rule-set.ts

@@ -58,6 +58,41 @@ export = {
     test.done();
   },
 
+  'drop spam rule should always appear first'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    new ReceiptRuleSet(stack, 'RuleSet', {
+      dropSpam: true,
+      rules: [
+        {
+          scanEnabled: true,
+          recipients: ['foo@example.com'],
+        },
+      ],
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::SES::ReceiptRule', {
+      Rule: {
+        Enabled: true,
+        Recipients: [
+          'foo@example.com',
+        ],
+        ScanEnabled: true,
+      },
+      // All "regular" rules should come after the drop spam rule
+      After: {
+        Ref: 'RuleSetDropSpamRule5809F51B',
+      },
+    }));
+
+    expect(stack).to(haveResource('AWS::Lambda::Function'));
+
+    test.done();
+  },
+
   'import receipt rule set'(test: Test) {
     // GIVEN
     const stack = new Stack();