SES setup for kan

terraform/ses.tf

@@ -0,0 +1,76 @@
+# SES domain verification and SMTP setup for dumpnet.chat
+
+resource "aws_ses_domain_identity" "dumpnet" {
+  domain = var.domain
+}
+
+resource "aws_ses_domain_dkim" "dumpnet" {
+  domain = aws_ses_domain_identity.dumpnet.domain
+}
+
+# DKIM DNS records (3 required)
+resource "aws_route53_record" "ses_dkim" {
+  count   = 3
+  zone_id = data.aws_route53_zone.dumpnet.zone_id
+  name    = "${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}._domainkey.${var.domain}"
+  type    = "CNAME"
+  ttl     = 300
+  records = ["${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}.dkim.amazonses.com"]
+}
+
+# Domain verification TXT record
+resource "aws_route53_record" "ses_verification" {
+  zone_id = data.aws_route53_zone.dumpnet.zone_id
+  name    = "_amazonses.${var.domain}"
+  type    = "TXT"
+  ttl     = 300
+  records = [aws_ses_domain_identity.dumpnet.verification_token]
+}
+
+resource "aws_ses_domain_identity_verification" "dumpnet" {
+  domain = aws_ses_domain_identity.dumpnet.id
+  depends_on = [aws_route53_record.ses_verification]
+}
+
+# SMTP credentials via IAM user
+resource "aws_iam_user" "ses_smtp" {
+  name = "${var.cluster_name}-ses-smtp"
+}
+
+resource "aws_iam_user_policy" "ses_smtp" {
+  name = "ses-send"
+  user = aws_iam_user.ses_smtp.name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = "ses:SendRawEmail"
+      Resource = "*"
+    }]
+  })
+}
+
+resource "aws_iam_access_key" "ses_smtp" {
+  user = aws_iam_user.ses_smtp.name
+}
+
+# Store SMTP credentials in Secrets Manager
+# Note: SES SMTP password is derived from the IAM secret key, not the key itself
+# The password must be calculated using the SES SMTP password algorithm
+locals {
+  ses_smtp_endpoint = "email-smtp.${var.aws_region}.amazonaws.com"
+}
+
+output "ses_smtp_endpoint" {
+  value = local.ses_smtp_endpoint
+}
+
+output "ses_smtp_username" {
+  value = aws_iam_access_key.ses_smtp.id
+}
+
+output "ses_smtp_password" {
+  value     = aws_iam_access_key.ses_smtp.ses_smtp_password_v4
+  sensitive = true
+}