77 lines
2 KiB
Terraform
77 lines
2 KiB
Terraform
|
# SES domain verification and SMTP setup for dumpnet.chat
|
||
|
|
|
||
|
|
resource "aws_ses_domain_identity" "dumpnet" {
|
||
|
|
domain = var.domain
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "aws_ses_domain_dkim" "dumpnet" {
|
||
|
|
domain = aws_ses_domain_identity.dumpnet.domain
|
||
|
|
}
|
||
|
|
|
||
|
|
# DKIM DNS records (3 required)
|
||
|
|
resource "aws_route53_record" "ses_dkim" {
|
||
|
|
count = 3
|
||
|
|
zone_id = data.aws_route53_zone.dumpnet.zone_id
|
||
|
|
name = "${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}._domainkey.${var.domain}"
|
||
|
|
type = "CNAME"
|
||
|
|
ttl = 300
|
||
|
|
records = ["${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}.dkim.amazonses.com"]
|
||
|
|
}
|
||
|
|
|
||
|
|
# Domain verification TXT record
|
||
|
|
resource "aws_route53_record" "ses_verification" {
|
||
|
|
zone_id = data.aws_route53_zone.dumpnet.zone_id
|
||
|
|
name = "_amazonses.${var.domain}"
|
||
|
|
type = "TXT"
|
||
|
|
ttl = 300
|
||
|
|
records = [aws_ses_domain_identity.dumpnet.verification_token]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "aws_ses_domain_identity_verification" "dumpnet" {
|
||
|
|
domain = aws_ses_domain_identity.dumpnet.id
|
||
|
|
depends_on = [aws_route53_record.ses_verification]
|
||
|
|
}
|
||
|
|
|
||
|
|
# SMTP credentials via IAM user
|
||
|
|
resource "aws_iam_user" "ses_smtp" {
|
||
|
|
name = "${var.cluster_name}-ses-smtp"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "aws_iam_user_policy" "ses_smtp" {
|
||
|
|
name = "ses-send"
|
||
|
|
user = aws_iam_user.ses_smtp.name
|
||
|
|
|
||
|
|
policy = jsonencode({
|
||
|
|
Version = "2012-10-17"
|
||
|
|
Statement = [{
|
||
|
|
Effect = "Allow"
|
||
|
|
Action = "ses:SendRawEmail"
|
||
|
|
Resource = "*"
|
||
|
|
}]
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "aws_iam_access_key" "ses_smtp" {
|
||
|
|
user = aws_iam_user.ses_smtp.name
|
||
|
|
}
|
||
|
|
|
||
|
|
# Store SMTP credentials in Secrets Manager
|
||
|
|
# Note: SES SMTP password is derived from the IAM secret key, not the key itself
|
||
|
|
# The password must be calculated using the SES SMTP password algorithm
|
||
|
|
locals {
|
||
|
|
ses_smtp_endpoint = "email-smtp.${var.aws_region}.amazonaws.com"
|
||
|
|
}
|
||
|
|
|
||
|
|
output "ses_smtp_endpoint" {
|
||
|
|
value = local.ses_smtp_endpoint
|
||
|
|
}
|
||
|
|
|
||
|
|
output "ses_smtp_username" {
|
||
|
|
value = aws_iam_access_key.ses_smtp.id
|
||
|
|
}
|
||
|
|
|
||
|
|
output "ses_smtp_password" {
|
||
|
|
value = aws_iam_access_key.ses_smtp.ses_smtp_password_v4
|
||
|
|
sensitive = true
|
||
|
|
}
|