Configures a domain hosted on Route53 to work with AWS Simple Email Service (SES).

Prerequisites

• Ensure terraform is installed
• Ensure domain is registered in route53
• Ensure an s3 bucket exists and SES has write permissions to it
• If you have an existing rule set you can skip creating the dependent resource
• Route53 zone id can be obtained by looking up the domain in route53 service

Getting Started

• Import the module called ses_domain and update its source property to trussworks/ses-domain/aws and run terrafrom init
• The next step is to configure the module with minimum values for SES to start working
• Once fully configured run terraform plan to see the execution plan and terrafrom apply to stand up SES

• MX record pointing to AWS's SMTP endpoint
• TXT record for SPF validation
• Custom MAIL FROM domain
• CNAME records for DKIM verification
• SES Verfication for the domain

NOTES

• SES is only available in a limited number of AWS Regions.
• SES out of the box locks the service in development mode; please see this documentation on how to make it production ready. Until the service is in production mode you can only send emails to confirmed email accounts denoted in from_addresses

Usage

See examples for functional examples on how to use this module.

module "ses_domain" {
  source             = "trussworks/ses-domain/aws"
  domain_name        = "example.com"
  mailfromdomain   = "email.example.com"
  route53zoneid    = data.awsroute53zone.sesdomain.zoneid
  from_addresses     = ["email1@example.com", "email2@example.com"]
  dmarc_rua          = "something@example.com"
  receives3bucket  = "S3bucketwithwritepermissions"
  receives3prefix  = "pathtostorereceivedemails"
  sesruleset       = "name-of-the-ruleset"
}
resource "awssesreceiptruleset" "name-of-the-ruleset" {   rulesetname = "name-of-the-ruleset" }
data "awsroute53zone" "ses_domain" {   name = "example.com" }

Requirements

| Name | Version | |------|---------| | terraform | >= 1.0 | | aws | >= 3.0 |

Providers

| Name | Version | |------|---------| | aws | >= 3.0 |

Modules

No modules.

Resources

| Name | Type | |------|------| | awsroute53record.dkim | resource | | awsroute53record.mx_receive | resource | | awsroute53record.mxsendmail_from | resource | | awsroute53record.spfmailfrom | resource | | awsroute53record.txt_dmarc | resource | | awssesreceiptrule.main | resource | | awssesv2emailidentity.main | resource | | awssesv2emailidentitymailfromattributes.main | resource | | awsregion.current | data source |

Inputs

| Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | dmarc\_p | DMARC Policy for organizational domains (none, quarantine, reject). | string | "none" | no | | dmarc\_rua | DMARC Reporting URI of aggregate reports, expects an email address. | string | n/a | yes | | domain\_name | The domain name to configure SES. | string | n/a | yes | | enable\_dmarc | Control whether to create DMARC TXT record. | bool | true | no | | enable\incoming\email | Control whether or not to handle incoming emails. | bool | true | no | | enable\spf\record | Control whether or not to set SPF records. | bool | true | no | | from\_addresses | List of email addresses to catch bounces and rejections. | list(string) | null | no | | mail\from\domain | Subdomain (of the route53 zone) which is to be used as MAIL FROM address | string | n/a | yes | | receive\s3\bucket | Name of the S3 bucket to store received emails (required if enable\incoming\email is true). | string | "" | no | | receive\s3\kms\key\arn | The ARN of the KMS key for S3 objects of received emails (effective if enable\incoming\email is true). | string | null | no | | receive\s3\prefix | The key prefix of the S3 bucket to store received emails (required if enable\incoming\email is true). | string | "" | no | | route53\zone\id | Route53 host zone ID to enable SES. | string | n/a | yes | | ses\rule\set | Name of the SES rule set to associate rules with. | string | n/a | yes |

Outputs

| Name | Description | |------|-------------| | ses\identity\arn | SES identity ARN. |

Developer Setup

Install dependencies (macOS)

brew install pre-commit go terraform terraform-docs