Add the SNS topic for SES bounce or complaint notifications

config/ses.tf

@@ -37,6 +37,52 @@ resource "aws_route53_record" "smtp_mail_from_mx" {
   depends_on = [aws_route53_zone.primary]
 }
 
+resource "aws_ses_configuration_set" "configuration_set" {
+  count = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  name  = "${var.eks_cluster_name}-ses-configuration-set"
+}
+
+resource "aws_sns_topic" "ses_bounce_event_topic" {
+  count = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  name  = "${var.eks_cluster_name}-ses-bounce-event-topic"
+}
+
+resource "aws_sns_topic_subscription" "ses_bounce_event_subscriptions" {
+  for_each = toset(var.ses_bounce_destinations)
+
+  topic_arn = aws_sns_topic.ses_bounce_event_topic[0].arn
+  protocol  = "email"
+  endpoint  = each.value
+}
+
+resource "aws_ses_identity_notification_topic" "ses_bounce_domain_identity" {
+  count                    = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  topic_arn                = aws_sns_topic.ses_bounce_event_topic[0].arn
+  notification_type        = "Bounce"
+  identity                 = keys(var.domain_name)[0]
+  include_original_headers = true
+}
+
+resource "aws_ses_identity_notification_topic" "ses_complaint_domain_identity" {
+  count                    = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  topic_arn                = aws_sns_topic.ses_bounce_event_topic[0].arn
+  notification_type        = "Complaint"
+  identity                 = keys(var.domain_name)[0]
+  include_original_headers = true
+}
+
+resource "aws_ses_event_destination" "sns" {
+  count                  = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  name                   = "${var.eks_cluster_name}-ses-event-destination-sns"
+  configuration_set_name = aws_ses_configuration_set.configuration_set[0].name
+  enabled                = true
+  matching_types         = ["bounce", "complaint"]
+
+  sns_destination {
+    topic_arn = aws_sns_topic.ses_bounce_event_topic[0].arn
+  }
+}
+
 resource "aws_route53_record" "smtp_mail_from_txt" {
   count   = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
   zone_id = aws_route53_zone.primary[0].zone_id
@@ -48,6 +94,17 @@ resource "aws_route53_record" "smtp_mail_from_txt" {
   depends_on = [aws_route53_zone.primary]
 }
 
+resource "aws_route53_record" "smtp_dmarc" {
+  count   = var.enable_route53 && length(var.domain_name) == 1 && var.enable_ses ? 1 : 0
+  zone_id = aws_route53_zone.primary[0].zone_id
+  name    = "_dmarc.${keys(var.domain_name)[0]}"
+  type    = "TXT"
+  ttl     = "300"
+  records = ["v=DMARC1; p=none;"]
+
+  depends_on = [aws_route53_zone.primary]
+}
+
 resource "aws_iam_user" "smtp_user" {
   count = var.enable_ses ? 1 : 0
 

config/terraform.tfvars

@@ -1,12 +1,13 @@
-AWS_REGION       = "eu-west-2"
-environment      = "dev"
-domain_name      = {} # Pair of top level domain and hosted zone ID for deployed applications, e.g., { "radar-base.org" : "ZABCDEFGHIJKLMNOPQRST" }
-with_dmz_pods    = false
-enable_metrics   = false
-enable_karpenter = false
-enable_msk       = false
-enable_rds       = false
-enable_route53   = false
-enable_ses       = false
-enable_s3        = false
-enable_eip       = false
+AWS_REGION              = "eu-west-2"
+environment             = "dev"
+domain_name             = {} # Pair of top level domain and hosted zone ID for deployed applications, e.g., { "radar-base.org" : "ZABCDEFGHIJKLMNOPQRST" }
+ses_bounce_destinations = [] # List of email addresses for receiving bounced email notifications, e.g., [ "[email protected]" ]
+with_dmz_pods           = false
+enable_metrics          = false
+enable_karpenter        = false
+enable_msk              = false
+enable_rds              = false
+enable_route53          = false
+enable_ses              = false
+enable_s3               = false
+enable_eip              = false

config/variables.tf

@@ -59,6 +59,12 @@ variable "domain_name" {
   }
 }
 
+variable "ses_bounce_destinations" {
+  type        = list(string)
+  description = "List of email addresses for receiving bounced email notifications"
+  default     = []
+}
+
 variable "instance_capacity_type" {
   type        = string
   description = "Capacity type used by EKS managed node groups"