Skip to content

Commit 29ad3f7

Browse files
robg-testrobg-test
committed
Revert "[PRMP-1538] Remove SES execution (#626)"
This reverts commit f511c43.
1 parent f511c43 commit 29ad3f7

13 files changed

Lines changed: 371 additions & 377 deletions

‎infrastructure/dns_email_auth.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
# resource "aws_route53_record" "dmarc" {
2-
# count = local.is_shared_workspace ? 1 : 0
3-
# zone_id = module.route53_fargate_ui.zone_id
4-
# name = "_dmarc.${var.domain}"
5-
# type = "TXT"
6-
# ttl = 300
7-
#
8-
# records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9-
# }
1+
resource "aws_route53_record" "dmarc" {
2+
count = local.is_shared_workspace ? 1 : 0
3+
zone_id = module.route53_fargate_ui.zone_id
4+
name = "_dmarc.${var.domain}"
5+
type = "TXT"
6+
ttl = 300
7+
8+
records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9+
}

‎infrastructure/iam.tf‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -354,37 +354,37 @@ resource "aws_iam_policy" "s3_document_data_policy_post_document_review_lambda"
354354
})
355355
}
356356

357-
# data "aws_iam_policy_document" "reporting_ses" {
358-
# statement {
359-
# sid = "SESAccess"
360-
# effect = "Allow"
361-
#
362-
# actions = [
363-
# "ses:SendEmail",
364-
# "ses:SendRawEmail"
365-
# ]
366-
#
367-
# resources = [
368-
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369-
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370-
# ]
371-
#
372-
# condition {
373-
# test = "StringEquals"
374-
# variable = "ses:FromAddress"
375-
# values = [local.reporting_ses_from_address_value]
376-
# }
377-
# }
378-
# }
379-
#
380-
# data "aws_iam_policy_document" "ses_feedback_s3_put" {
381-
# statement {
382-
# effect = "Allow"
383-
# actions = [
384-
# "s3:PutObject"
385-
# ]
386-
# resources = [
387-
# "${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388-
# ]
389-
# }
390-
# }
357+
data "aws_iam_policy_document" "reporting_ses" {
358+
statement {
359+
sid = "SESAccess"
360+
effect = "Allow"
361+
362+
actions = [
363+
"ses:SendEmail",
364+
"ses:SendRawEmail"
365+
]
366+
367+
resources = [
368+
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369+
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370+
]
371+
372+
condition {
373+
test = "StringEquals"
374+
variable = "ses:FromAddress"
375+
values = [local.reporting_ses_from_address_value]
376+
}
377+
}
378+
}
379+
380+
data "aws_iam_policy_document" "ses_feedback_s3_put" {
381+
statement {
382+
effect = "Allow"
383+
actions = [
384+
"s3:PutObject"
385+
]
386+
resources = [
387+
"${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388+
]
389+
}
390+
}

‎infrastructure/kms_sns.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ module "sns_encryption_key" {
44
kms_key_description = "Custom KMS Key to enable server side encryption for sns subscriptions"
55
environment = var.environment
66
owner = var.owner
7-
# service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
8-
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
7+
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
98
kms_deletion_window = var.kms_deletion_window
109
}

‎infrastructure/lambda-report-distribution.tf‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
# module "report-distribution-lambda" {
2-
# source = "./modules/lambda"
3-
# name = "ReportDistribution"
4-
# handler = "handlers.report_distribution_handler.lambda_handler"
5-
# lambda_timeout = 300
6-
#
7-
# iam_role_policy_documents = [
8-
# module.ndr-report-store.s3_read_policy_document,
9-
# module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10-
# data.aws_iam_policy_document.reporting_ses.json,
11-
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12-
# ]
13-
#
14-
# lambda_environment_variables = {
15-
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16-
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17-
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18-
# WORKSPACE = terraform.workspace
19-
#
20-
# REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21-
# CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22-
#
23-
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24-
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25-
# SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26-
# }
27-
#
28-
# is_gateway_integration_needed = false
29-
# is_invoked_from_gateway = false
30-
# }
1+
module "report-distribution-lambda" {
2+
source = "./modules/lambda"
3+
name = "ReportDistribution"
4+
handler = "handlers.report_distribution_handler.lambda_handler"
5+
lambda_timeout = 300
6+
7+
iam_role_policy_documents = [
8+
module.ndr-report-store.s3_read_policy_document,
9+
module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10+
data.aws_iam_policy_document.reporting_ses.json,
11+
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12+
]
13+
14+
lambda_environment_variables = {
15+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18+
WORKSPACE = terraform.workspace
19+
20+
REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21+
CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22+
23+
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24+
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25+
SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26+
}
27+
28+
is_gateway_integration_needed = false
29+
is_invoked_from_gateway = false
30+
}

‎infrastructure/lambda-ses-feedback-monitor.tf‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,32 @@
1-
# module "ses-feedback-monitor-lambda" {
2-
# source = "./modules/lambda"
3-
# name = "SesFeedbackMonitor"
4-
# handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5-
# lambda_timeout = 60
6-
#
7-
# iam_role_policy_documents = [
8-
# data.aws_iam_policy_document.ses_feedback_s3_put.json,
9-
# data.aws_iam_policy_document.reporting_ses.json,
10-
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11-
# ]
12-
#
13-
# lambda_environment_variables = {
14-
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15-
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16-
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17-
# WORKSPACE = terraform.workspace
18-
#
19-
# SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20-
# SES_FEEDBACK_PREFIX = "ses-feedback/"
21-
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22-
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23-
# ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24-
# }
25-
#
26-
# is_gateway_integration_needed = false
27-
# is_invoked_from_gateway = false
28-
#
29-
# depends_on = [
30-
# module.ses-feedback-store
31-
# ]
32-
# }
1+
module "ses-feedback-monitor-lambda" {
2+
source = "./modules/lambda"
3+
name = "SesFeedbackMonitor"
4+
handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5+
lambda_timeout = 60
6+
7+
iam_role_policy_documents = [
8+
data.aws_iam_policy_document.ses_feedback_s3_put.json,
9+
data.aws_iam_policy_document.reporting_ses.json,
10+
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11+
]
12+
13+
lambda_environment_variables = {
14+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17+
WORKSPACE = terraform.workspace
18+
19+
SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20+
SES_FEEDBACK_PREFIX = "ses-feedback/"
21+
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22+
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23+
ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24+
}
25+
26+
is_gateway_integration_needed = false
27+
is_invoked_from_gateway = false
28+
29+
depends_on = [
30+
module.ses-feedback-store
31+
]
32+
}

‎infrastructure/modules/sns/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ module "sns_topic" {
7979
| Name | Type |
8080
|------|------|
8181
| [aws_sns_topic.sns_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
82+
| [aws_sns_topic_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
8283
| [aws_sns_topic_subscription.sns_subscription_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8384
| [aws_sns_topic_subscription.sns_subscription_single](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8485

@@ -89,13 +90,16 @@ module "sns_topic" {
8990
| <a name="input_delivery_policy"></a> [delivery\_policy](#input\_delivery\_policy) | Attach delivery or IAM policy. (Legacy name; used as topic policy JSON in this module.) | `string` | n/a | yes |
9091
| <a name="input_enable_deduplication"></a> [enable\_deduplication](#input\_enable\_deduplication) | Prevent content based duplication in notification queue. | `bool` | `false` | no |
9192
| <a name="input_enable_fifo"></a> [enable\_fifo](#input\_enable\_fifo) | Attach first in first out policy to notification queue. | `bool` | `false` | no |
93+
| <a name="input_enable_ses_publish"></a> [enable\_ses\_publish](#input\_enable\_ses\_publish) | If true, module appends a statement allowing ses.amazonaws.com to SNS:Publish to this topic. | `bool` | `false` | no |
9294
| <a name="input_is_topic_endpoint_list"></a> [is\_topic\_endpoint\_list](#input\_is\_topic\_endpoint\_list) | Whether to use the topic\_endpoint\_list instead of a single topic\_endpoint. | `bool` | `false` | no |
9395
| <a name="input_raw_message_delivery"></a> [raw\_message\_delivery](#input\_raw\_message\_delivery) | Whether to enable raw message delivery for the SNS subscription. | `bool` | `false` | no |
96+
| <a name="input_ses_source_account_id"></a> [ses\_source\_account\_id](#input\_ses\_source\_account\_id) | AWS account ID used in the AWS:SourceAccount condition for SES publishing. | `string` | `""` | no |
9497
| <a name="input_sns_encryption_key_id"></a> [sns\_encryption\_key\_id](#input\_sns\_encryption\_key\_id) | The ARN (or ID) of the KMS key used for encrypting the SNS topic. | `string` | n/a | yes |
9598
| <a name="input_sqs_feedback"></a> [sqs\_feedback](#input\_sqs\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback. | `map(string)` | `{}` | no |
9699
| <a name="input_topic_endpoint"></a> [topic\_endpoint](#input\_topic\_endpoint) | A single endpoint (e.g., SQS queue or Lambda function ARN) to subscribe to the topic. | `any` | `null` | no |
97100
| <a name="input_topic_endpoint_list"></a> [topic\_endpoint\_list](#input\_topic\_endpoint\_list) | A list of endpoints (e.g., SQS ARNs) to subscribe to the topic. | `any` | `[]` | no |
98101
| <a name="input_topic_name"></a> [topic\_name](#input\_topic\_name) | Name of the SNS topic. | `string` | n/a | yes |
102+
| <a name="input_topic_policy_json"></a> [topic\_policy\_json](#input\_topic\_policy\_json) | Optional SNS topic access policy JSON. If set, it overrides delivery\_policy. | `string` | `null` | no |
99103
| <a name="input_topic_protocol"></a> [topic\_protocol](#input\_topic\_protocol) | The protocol to use for the subscription (e.g., 'sqs', 'lambda'). | `string` | n/a | yes |
100104

101105
## Outputs

‎infrastructure/modules/sns/main.tf‎

Lines changed: 48 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,48 @@
1-
# locals {
2-
# base_topic_policy_json = var.topic_policy_json != null ? var.topic_policy_json : var.delivery_policy
3-
# base_topic_policy_obj = jsondecode(local.base_topic_policy_json)
4-
# normalized_statements = [
5-
# for s in try(local.base_topic_policy_obj["Statement"], []) : merge(
6-
# s,
7-
# {
8-
# Resource = (
9-
# try(s["Resource"], null) == "*" || try(s["Resource"], null) == null
10-
# ? aws_sns_topic.sns_topic.arn
11-
# : s["Resource"]
12-
# )
13-
# }
14-
# )
15-
# ]
16-
#
17-
# ses_publish_statement = var.enable_ses_publish ? {
18-
# Sid = "AllowSESPublish"
19-
# Effect = "Allow"
20-
# Principal = {
21-
# Service = "ses.amazonaws.com"
22-
# }
23-
# Action = "SNS:Publish"
24-
# Resource = aws_sns_topic.sns_topic.arn
25-
# Condition = {
26-
# StringEquals = {
27-
# "AWS:SourceAccount" = var.ses_source_account_id
28-
# }
29-
# }
30-
# } : null
31-
#
32-
# effective_topic_policy_obj = merge(
33-
# local.base_topic_policy_obj,
34-
# {
35-
# Statement = concat(
36-
# local.normalized_statements,
37-
# var.enable_ses_publish ? [local.ses_publish_statement] : []
38-
# )
39-
# }
40-
# )
41-
# effective_topic_policy_json = jsonencode(local.effective_topic_policy_obj)
42-
# }
1+
locals {
2+
base_topic_policy_json = var.topic_policy_json != null ? var.topic_policy_json : var.delivery_policy
3+
base_topic_policy_obj = jsondecode(local.base_topic_policy_json)
4+
normalized_statements = [
5+
for s in try(local.base_topic_policy_obj["Statement"], []) : merge(
6+
s,
7+
{
8+
Resource = (
9+
try(s["Resource"], null) == "*" || try(s["Resource"], null) == null
10+
? aws_sns_topic.sns_topic.arn
11+
: s["Resource"]
12+
)
13+
}
14+
)
15+
]
16+
17+
ses_publish_statement = var.enable_ses_publish ? {
18+
Sid = "AllowSESPublish"
19+
Effect = "Allow"
20+
Principal = {
21+
Service = "ses.amazonaws.com"
22+
}
23+
Action = "SNS:Publish"
24+
Resource = aws_sns_topic.sns_topic.arn
25+
Condition = {
26+
StringEquals = {
27+
"AWS:SourceAccount" = var.ses_source_account_id
28+
}
29+
}
30+
} : null
31+
32+
effective_topic_policy_obj = merge(
33+
local.base_topic_policy_obj,
34+
{
35+
Statement = concat(
36+
local.normalized_statements,
37+
var.enable_ses_publish ? [local.ses_publish_statement] : []
38+
)
39+
}
40+
)
41+
effective_topic_policy_json = jsonencode(local.effective_topic_policy_obj)
42+
}
4343

4444
resource "aws_sns_topic" "sns_topic" {
4545
name_prefix = "${terraform.workspace}-sns-${var.topic_name}"
46-
policy = var.delivery_policy
4746
fifo_topic = var.enable_fifo
4847
content_based_deduplication = var.enable_deduplication
4948
kms_master_key_id = var.sns_encryption_key_id
@@ -53,10 +52,10 @@ resource "aws_sns_topic" "sns_topic" {
5352
sqs_success_feedback_sample_rate = try(var.sqs_feedback.success_sample_rate, null)
5453
}
5554

56-
# resource "aws_sns_topic_policy" "this" {
57-
# arn = aws_sns_topic.sns_topic.arn
58-
# policy = local.effective_topic_policy_json
59-
# }
55+
resource "aws_sns_topic_policy" "this" {
56+
arn = aws_sns_topic.sns_topic.arn
57+
policy = local.effective_topic_policy_json
58+
}
6059

6160
resource "aws_sns_topic_subscription" "sns_subscription_single" {
6261
count = var.is_topic_endpoint_list ? 0 : 1
@@ -65,7 +64,7 @@ resource "aws_sns_topic_subscription" "sns_subscription_single" {
6564
endpoint = var.topic_endpoint
6665
raw_message_delivery = var.raw_message_delivery
6766

68-
# depends_on = [aws_sns_topic_policy.this]
67+
depends_on = [aws_sns_topic_policy.this]
6968
}
7069

7170
resource "aws_sns_topic_subscription" "sns_subscription_list" {
@@ -75,7 +74,7 @@ resource "aws_sns_topic_subscription" "sns_subscription_list" {
7574
endpoint = each.value
7675
raw_message_delivery = var.raw_message_delivery
7776

78-
# depends_on = [aws_sns_topic_policy.this]
77+
depends_on = [aws_sns_topic_policy.this]
7978
}
8079

8180
output "arn" {

0 commit comments

Comments
 (0)