terraform-aws-mcaf-ses-forwarder

Terraform module to configure a SES forwarder.

Loosely based on the Forward Incoming Email to an External Destination blog post in combination with the aws-lambda-ses-forwarder by @arithmetric, this Terraform module creates the necessary resources to accept mail sent to a verified email address and forward it to an external recipient or recipients.

How it works

This solution uses several AWS services to forward incoming emails to one or more external email addresses. The following diagram shows the flow of information in this solution:

1. A new email is sent from an external sender to your domain. Amazon SES handles the incoming email for your domain.
2. An Amazon SES receipt rule saves the incoming message in an S3 bucket.
3. An Amazon SES receipt rule triggers the execution of a Lambda function.
4. The Lambda function retrieves the message content from S3, and then creates a new message and sends it to Amazon SES.
5. Amazon SES sends the message to the destination server.

To gain a more indepth understanding of this setup it's recommended to give both links mentioned above a read through.

Example usage

In combination with the terraform-aws-mcaf-ses module to configure SES, the following creates the S3 bucket, lambda and SES rule set to accept mail sent to hello@app.dev and forward it to user1@company.io and user2@company.io:

provider "aws" {
  alias = "lambda"
}

provider "aws" {
  alias = "route53"
}

module "ses" {
  providers = { aws = aws, aws.route53 = aws.route53 }

  source = "github.com/schubergphilis/terraform-aws-mcaf-ses"
  domain = "app.dev"
  tags   = {}
}

module "ses-forwarder" {
  providers = { aws = aws, aws.lambda = aws.lambda }

  source      = "github.com/schubergphilis/terraform-aws-mcaf-ses-forwarder"
  bucket_name = "app-dev-ses-forwarder"
  from_email  = "ses@app.dev"
  tags        = {}

  recipient_mapping = {
    "hello@app.dev" = ["user1@company.io", "user2@company.io"]
  }
}

To match all email addresses on a domain, use a key without the name part of an email address before the "at" symbol:

module "ses-forwarder" {
  ...
  recipient_mapping = {
    "@app.dev" = ["user1@company.io", "user2@company.io"]
  }
}

Requirements

Name	Version
terraform	>= 1.4.0
archive	>= 2.0.0
aws	>= 6.0.0

Providers

Name	Version
archive	>= 2.0.0
aws	>= 6.0.0

Modules

Name	Source	Version
lambda	schubergphilis-ep/mcaf-lambda/aws	~> 3.0.0
s3_bucket	schubergphilis-ep/mcaf-s3/aws	~> 2.0.0

Resources

Name	Type
aws_lambda_permission.allow_ses	resource
aws_ses_active_receipt_rule_set.default	resource
aws_ses_receipt_rule.default	resource
aws_ses_receipt_rule_set.default	resource
aws_sqs_queue.lambda_dlq	resource
archive_file.lambda	data source
aws_caller_identity.default	data source
aws_iam_policy_document.lambda_policy	data source
aws_iam_policy_document.logs_bucket	data source
aws_region.default	data source

Inputs

Name	Description	Type	Default	Required
bucket_name	S3 bucket name where SES stores emails	string	n/a	yes
from_email	Forwarded emails will come from this verified address	string	n/a	yes
recipient_mapping	Map of recipients and the addresses to forward on to	map(any)	n/a	yes
allow_plus_sign	Enables support for plus sign suffixes on email addresses	bool	true	no
bucket_lifecycle_rules	S3 bucket lifecycle rules	list(any)	[ { "enabled": true, "expiration": { "days": 14 }, "id": "two-week-retention", "noncurrent_version_expiration": { "noncurrent_days": 14 } } ]	no
bucket_prefix	S3 key name prefix where SES stores email	string	"inbound-mail"	no
kms_key_arn	KMS key ARN used for encryption	string	null	no
lambda_name	The name of the Lambda function	string	"EmailForwarder"	no
region	The AWS region where the resources will be created. If omitted, the default provider region is used.	string	null	no
ses_rule_name	The name of the SES rule that invokes the Lambda function	string	"EmailForwarder"	no
ses_rule_set_name	The name of the active Rule Set in SES which you have already configured	string	"EmailForwarder"	no
subject_prefix	String to prepend to the subject of forwarded mail	string	""	no
tags	Map of tags to set on Terraform created resources	map(string)	null	no

Outputs

No outputs.