CCM-10296: create internal ses domain with option for overload

harrim91 · harrim91 · commit 071bcb8b9ec8 · 2025-06-18T13:05:03.000+01:00
diff --git a/infrastructure/terraform/components/app/README.md b/infrastructure/terraform/components/app/README.md
@@ -43,6 +43,7 @@
 | <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
 | <a name="input_retention_period"></a> [retention\_period](#input\_retention\_period) | Backup Vault Retention Period | `number` | `14` | no |
+| <a name="input_ses_overload_domain"></a> [ses\_overload\_domain](#input\_ses\_overload\_domain) | Additional SES domain identity (e.g. from an external domain). Validation DNS records will need to be manually configured in the DNS provider. | `string` | `null` | no |
 | <a name="input_url_prefix"></a> [url\_prefix](#input\_url\_prefix) | The url prefix to use for the deployed branch | `string` | `"main"` | no |
 ## Modules
 
diff --git a/infrastructure/terraform/components/app/route53_record_ses_dkim_validation_main.tf b/infrastructure/terraform/components/app/route53_record_ses_dkim_validation_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_dkim_validation" {
+resource "aws_route53_record" "ses_dkim_validation_main" {
   count = 3
 
   zone_id = local.acct.dns_zone["id"]
diff --git a/infrastructure/terraform/components/app/route53_record_ses_dmarc_main.tf b/infrastructure/terraform/components/app/route53_record_ses_dmarc_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_dmarc" {
+resource "aws_route53_record" "ses_dmarc_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = "_dmarc.${aws_ses_domain_identity.main.id}"
   type    = "TXT"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_mail_from_mx_main.tf b/infrastructure/terraform/components/app/route53_record_ses_mail_from_mx_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_mail_from_mx" {
+resource "aws_route53_record" "ses_mail_from_mx_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = aws_ses_domain_mail_from.main.mail_from_domain
   type    = "MX"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_mail_from_txt_main.tf b/infrastructure/terraform/components/app/route53_record_ses_mail_from_txt_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_mail_from_txt" {
+resource "aws_route53_record" "ses_mail_from_txt_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = aws_ses_domain_mail_from.main.mail_from_domain
   type    = "TXT"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_validation_main.tf b/infrastructure/terraform/components/app/route53_record_ses_validation_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_validation" {
+resource "aws_route53_record" "ses_validation_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = "_amazonses.${aws_ses_domain_identity.main.id}"
   type    = "TXT"
diff --git a/infrastructure/terraform/components/app/ses_domain_dkim_main.tf b/infrastructure/terraform/components/app/ses_domain_dkim_main.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_dkim_overload.tf b/infrastructure/terraform/components/app/ses_domain_dkim_overload.tf
@@ -0,0 +1,5 @@
+resource "aws_ses_domain_dkim" "overload" {
+  count = var.ses_overload_domain == null ? 0 : 1
+
+  domain = aws_ses_domain_identity.overload[0].domain
+}
diff --git a/infrastructure/terraform/components/app/ses_domain_identity_main.tf b/infrastructure/terraform/components/app/ses_domain_identity_main.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_identity_overload.tf b/infrastructure/terraform/components/app/ses_domain_identity_overload.tf
@@ -0,0 +1,5 @@
+resource "aws_ses_domain_identity" "overload" {
+  count = var.ses_overload_domain == null ? 0 : 1
+
+  domain = var.ses_overload_domain
+}
diff --git a/infrastructure/terraform/components/app/ses_domain_mail_from_main.tf b/infrastructure/terraform/components/app/ses_domain_mail_from_main.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_mail_from_overload.tf b/infrastructure/terraform/components/app/ses_domain_mail_from_overload.tf
@@ -0,0 +1,6 @@
+resource "aws_ses_domain_mail_from" "overload" {
+  count = var.ses_overload_domain == null ? 0 : 1
+
+  domain           = aws_ses_domain_identity.overload[0].domain
+  mail_from_domain = "mail.${aws_ses_domain_identity.overload[0].domain}"
+}
diff --git a/infrastructure/terraform/components/app/variables.tf b/infrastructure/terraform/components/app/variables.tf
@@ -211,3 +211,9 @@ variable "letter_suppliers" {
 
   description = "Letter suppliers enabled in the environment"
 }
+
+variable "ses_overload_domain" {
+  type        = string
+  default     = null
+  description = "Additional SES domain identity (e.g. from an external domain). Validation DNS records will need to be manually configured in the DNS provider."
+}

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_dkim_validation" {`
	`1`	`+resource "aws_route53_record" "ses_dkim_validation_main" {`
`2`	`2`	`count = 3`
`3`	`3`
`4`	`4`	`zone_id = local.acct.dns_zone["id"]`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_dmarc" {`
	`1`	`+resource "aws_route53_record" "ses_dmarc_main" {`
`2`	`2`	`zone_id = local.acct.dns_zone["id"]`
`3`	`3`	`name = "_dmarc.${aws_ses_domain_identity.main.id}"`
`4`	`4`	`type = "TXT"`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_mail_from_mx" {`
	`1`	`+resource "aws_route53_record" "ses_mail_from_mx_main" {`
`2`	`2`	`zone_id = local.acct.dns_zone["id"]`
`3`	`3`	`name = aws_ses_domain_mail_from.main.mail_from_domain`
`4`	`4`	`type = "MX"`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_validation" {`
	`1`	`+resource "aws_route53_record" "ses_validation_main" {`
`2`	`2`	`zone_id = local.acct.dns_zone["id"]`
`3`	`3`	`name = "_amazonses.${aws_ses_domain_identity.main.id}"`
`4`	`4`	`type = "TXT"`