+ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
+
+ {{/ preheader }}
+
+
+
+
+
+
+
+
+
+
+ {{#body_title}}
+
+ |
+
+ {{body_title}}
+
+ |
+
+ {{/body_title}}
+ {{#body_detail}}
+
+ |
+
+ {{{body_detail}}}
+
+ |
+
+ {{/body_detail}}
+
+ |
+
+
+ |
+
+
+ |
+
+
+{{{additional_body}}}
diff --git a/terraform/production.tfvars b/terraform/production.tfvars
index a56ac98c..c2465064 100644
--- a/terraform/production.tfvars
+++ b/terraform/production.tfvars
@@ -43,3 +43,6 @@ passage_app_id = "ysWup7gbVOMXhRCwzjXmDnQ8"
// API
api_domain_name = "api.cpf.grants.usdigitalresponse.org"
+
+// Email for treasury notifications
+notifications_email_address = "grants-notifications@cpf.grants.usdigitalresponse.org"
diff --git a/terraform/staging.tfvars b/terraform/staging.tfvars
index 0982b604..5dea4f11 100644
--- a/terraform/staging.tfvars
+++ b/terraform/staging.tfvars
@@ -42,3 +42,6 @@ passage_app_id = "OjNe5PvwdKm6rmcFc1WfPIBa"
// API
api_domain_name = "api.staging.cpf.usdr.dev"
+
+// Email for treasury notifications
+notifications_email_address = "grants-notifications@staging.cpf.usdr.dev"
diff --git a/terraform/treasury_generation_lambda_functions.tf b/terraform/treasury_generation_lambda_functions.tf
index c1a169f6..feed9711 100644
--- a/terraform/treasury_generation_lambda_functions.tf
+++ b/terraform/treasury_generation_lambda_functions.tf
@@ -360,3 +360,87 @@ module "lambda_function-cpfCreateArchive" {
}
}
}
+data "aws_ses_domain_identity" "notifications" {
+ domain = split("@", var.notifications_email_address)[1]
+}
+
+module "lambda_function-email-presigned-url" {
+ source = "terraform-aws-modules/lambda/aws"
+ version = "6.5.0"
+
+ // Metadata
+ function_name = "${var.namespace}-email-presigned-url"
+ description = "Send email with presigned URL for treasury report."
+
+ // Networking
+ vpc_subnet_ids = null
+ vpc_security_group_ids = null
+ attach_network_policy = false
+
+ // Permissions
+ role_permissions_boundary = local.permissions_boundary_arn
+ attach_cloudwatch_logs_policy = true
+ cloudwatch_logs_retention_in_days = var.log_retention_in_days
+ attach_policy_jsons = length(local.lambda_default_execution_policies) > 0
+ number_of_policy_jsons = length(local.lambda_default_execution_policies)
+ policy_jsons = local.lambda_default_execution_policies
+ attach_policy_statements = true
+ policy_statements = {
+ AllowGetZipFile = {
+ effect = "Allow"
+ actions = [
+ "s3:GetObject",
+ "s3:HeadObject",
+ ]
+ resources = [
+ # Path: treasuryreports/{organization_id}/{reporting_period_id}/{filename}.zip
+ "${module.reporting_data_bucket.bucket_arn}/treasuryreports/*/*/*.zip",
+ ]
+ }
+ AllowSendEmails = {
+ effect = "Allow"
+ actions = [
+ "ses:SendEmail",
+ "ses:SendRawEmail"
+ ]
+ resources = [
+ data.aws_ses_domain_identity.notifications.arn,
+ ]
+ conditions = [
+ {
+ test = "StringLike"
+ variable = "ses:FromAddress"
+ values = [var.notifications_email_address]
+ }
+ ]
+ }
+ }
+
+ // Artifacts
+ publish = true
+ create_package = false
+ s3_existing_package = {
+ bucket = aws_s3_object.lambda_artifact-python.bucket
+ key = aws_s3_object.lambda_artifact-python.key
+ }
+
+ // Runtime
+ handler = var.datadog_enabled ? local.datadog_lambda_py_handler : "src.functions.generate_presigned_url_and_send_email"
+ runtime = var.lambda_py_runtime
+ architectures = [var.lambda_arch]
+ layers = local.lambda_py_layer_arns
+ timeout = 60 # 1 minute, in seconds
+ memory_size = 512
+ environment_variables = merge(local.lambda_default_environment_variables, {
+ DD_LAMBDA_HANDLER = "src.functions.generate_presigned_url_and_send_email"
+ DD_LOGS_INJECTION = "true"
+ })
+
+ // Triggers
+ allowed_triggers = {
+ StepFunctionTrigger = {
+ principal = "states.amazonaws.com"
+ source_arn = module.treasury_generation_step_function.state_machine_arn
+ }
+ }
+}
diff --git a/terraform/variables.tf b/terraform/variables.tf
index a4071414..21a58ec0 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -315,3 +315,14 @@ variable "postgres_ca_cert_identifier" {
description = "Certificate Authority identifier for RDS Aurora Postgres cluster instances."
type = string
}
+
+// email
+variable "notifications_email_address" {
+ description = "SES domain from which email notifications should be sent."
+ type = string
+ validation {
+ condition = length(split("@", var.notifications_email_address)) == 2
+ error_message = "Email address must contain exactly one @ sign."
+ }
+}
+