CCM-10296: ses setup (#522)

harrim91 · web-flow · commit 8f1c6eef38e2 · 2025-06-24T13:22:50.000+01:00
diff --git a/infrastructure/terraform/components/app/README.md b/infrastructure/terraform/components/app/README.md
@@ -34,6 +34,7 @@
 | <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
 | <a name="input_event_delivery_logging"></a> [event\_delivery\_logging](#input\_event\_delivery\_logging) | Enable SNS Event Delivery logging | `bool` | `true` | no |
 | <a name="input_event_delivery_logging_success_sample_percentage"></a> [event\_delivery\_logging\_success\_sample\_percentage](#input\_event\_delivery\_logging\_success\_sample\_percentage) | Enable caching of events to an S3 bucket | `number` | `0` | no |
+| <a name="input_external_email_domain"></a> [external\_email\_domain](#input\_external\_email\_domain) | Externally managed domain used to create an SES identity for sending emails from. Validation DNS records will need to be manually configured in the DNS provider. | `string` | `null` | no |
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
 | <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
 | <a name="input_letter_suppliers"></a> [letter\_suppliers](#input\_letter\_suppliers) | Letter suppliers enabled in the environment | <pre>map(object({<br/>    enable_polling   = bool<br/>    default_supplier = optional(bool)<br/>  }))</pre> | `{}` | no |
diff --git a/infrastructure/terraform/components/app/route53_record_ses_dkim_validation_main.tf b/infrastructure/terraform/components/app/route53_record_ses_dkim_validation_main.tf
@@ -1,8 +1,8 @@
-resource "aws_route53_record" "ses_dkim_validation" {
+resource "aws_route53_record" "ses_dkim_validation_main" {
   count = 3
 
   zone_id = local.acct.dns_zone["id"]
-  name    = "${aws_ses_domain_dkim.main.dkim_tokens[count.index]}._domainkey"
+  name    = "${aws_ses_domain_dkim.main.dkim_tokens[count.index]}._domainkey.${aws_ses_domain_identity.main.id}"
   type    = "CNAME"
   ttl     = "300"
   records = [
diff --git a/infrastructure/terraform/components/app/route53_record_ses_dmarc_main.tf b/infrastructure/terraform/components/app/route53_record_ses_dmarc_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_dmarc" {
+resource "aws_route53_record" "ses_dmarc_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = "_dmarc.${aws_ses_domain_identity.main.id}"
   type    = "TXT"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_mail_from_mx_main.tf b/infrastructure/terraform/components/app/route53_record_ses_mail_from_mx_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_mail_from_mx" {
+resource "aws_route53_record" "ses_mail_from_mx_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = aws_ses_domain_mail_from.main.mail_from_domain
   type    = "MX"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_mail_from_txt_main.tf b/infrastructure/terraform/components/app/route53_record_ses_mail_from_txt_main.tf
@@ -1,4 +1,4 @@
-resource "aws_route53_record" "ses_mail_from_txt" {
+resource "aws_route53_record" "ses_mail_from_txt_main" {
   zone_id = local.acct.dns_zone["id"]
   name    = aws_ses_domain_mail_from.main.mail_from_domain
   type    = "TXT"
diff --git a/infrastructure/terraform/components/app/route53_record_ses_validation.tf b/infrastructure/terraform/components/app/route53_record_ses_validation.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_dkim_external.tf b/infrastructure/terraform/components/app/ses_domain_dkim_external.tf
@@ -0,0 +1,5 @@
+resource "aws_ses_domain_dkim" "external" {
+  count = var.external_email_domain == null ? 0 : 1
+
+  domain = aws_ses_domain_identity.external[0].domain
+}
diff --git a/infrastructure/terraform/components/app/ses_domain_dkim_main.tf b/infrastructure/terraform/components/app/ses_domain_dkim_main.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_identity_external.tf b/infrastructure/terraform/components/app/ses_domain_identity_external.tf
@@ -0,0 +1,5 @@
+resource "aws_ses_domain_identity" "external" {
+  count = var.external_email_domain == null ? 0 : 1
+
+  domain = var.external_email_domain
+}
diff --git a/infrastructure/terraform/components/app/ses_domain_identity_main.tf b/infrastructure/terraform/components/app/ses_domain_identity_main.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_mail_from.tf b/infrastructure/terraform/components/app/ses_domain_mail_from.tf
diff --git a/infrastructure/terraform/components/app/ses_domain_mail_from_external.tf b/infrastructure/terraform/components/app/ses_domain_mail_from_external.tf
@@ -0,0 +1,7 @@
+resource "aws_ses_domain_mail_from" "external" {
+  count = var.external_email_domain == null ? 0 : 1
+
+  domain                 = aws_ses_domain_identity.external[0].domain
+  mail_from_domain       = "mail.${aws_ses_domain_identity.external[0].domain}"
+  behavior_on_mx_failure = "RejectMessage"
+}
diff --git a/infrastructure/terraform/components/app/ses_domain_mail_from_main.tf b/infrastructure/terraform/components/app/ses_domain_mail_from_main.tf
@@ -0,0 +1,5 @@
+resource "aws_ses_domain_mail_from" "main" {
+  domain                 = aws_ses_domain_identity.main.domain
+  mail_from_domain       = "mail.${aws_ses_domain_identity.main.domain}"
+  behavior_on_mx_failure = "RejectMessage"
+}
diff --git a/infrastructure/terraform/components/app/variables.tf b/infrastructure/terraform/components/app/variables.tf
@@ -211,3 +211,9 @@ variable "letter_suppliers" {
 
   description = "Letter suppliers enabled in the environment"
 }
+
+variable "external_email_domain" {
+  type        = string
+  default     = null
+  description = "Externally managed domain used to create an SES identity for sending emails from. Validation DNS records will need to be manually configured in the DNS provider."
+}

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_dmarc" {`
	`1`	`+resource "aws_route53_record" "ses_dmarc_main" {`
`2`	`2`	`zone_id = local.acct.dns_zone["id"]`
`3`	`3`	`name = "_dmarc.${aws_ses_domain_identity.main.id}"`
`4`	`4`	`type = "TXT"`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-resource "aws_route53_record" "ses_mail_from_mx" {`
	`1`	`+resource "aws_route53_record" "ses_mail_from_mx_main" {`
`2`	`2`	`zone_id = local.acct.dns_zone["id"]`
`3`	`3`	`name = aws_ses_domain_mail_from.main.mail_from_domain`
`4`	`4`	`type = "MX"`