add: ses module

aws/ses/cloudflare.tf

@@ -0,0 +1,53 @@
+resource "cloudflare_record" "domain_amazonses_verification_record" {
+  count = var.cloudflare_zone != null ? 1 : 0
+
+  zone_id = var.cloudflare_zone
+  name    = "_amazonses.${var.ses_domain}."
+  type    = "TXT"
+  value   = aws_ses_domain_identity.domain.verification_token
+  proxied = false
+  ttl     = 60
+}
+
+resource "cloudflare_record" "domain_amazonses_dkim_record" {
+  count = var.cloudflare_zone != null ? 3 : 0
+
+  zone_id = var.cloudflare_zone
+  name    = "${element(aws_ses_domain_dkim.dkim.dkim_tokens, count.index)}._domainkey.${var.ses_domain}."
+  type    = "CNAME"
+  value   = "${element(aws_ses_domain_dkim.dkim.dkim_tokens, count.index)}.dkim.amazonses.com"
+  proxied = false
+  ttl     = 60
+}
+
+resource "cloudflare_record" "spf_record" {
+  count = var.cloudflare_zone != null ? 1 : 0
+
+  zone_id = var.cloudflare_zone
+  name    = var.domain
+  type    = "TXT"
+  value   = "v=spf1 include:amazonses.com ~all"
+  proxied = false
+  ttl     = 60
+}
+
+resource "aws_ses_domain_identity_verification" "main" {
+  domain = aws_ses_domain_identity.domain.id
+
+  depends_on = [
+    aws_route53_record.domain_amazonses_verification_record,
+    cloudflare_record.domain_amazonses_verification_record,
+  ]
+}
+
+resource "cloudflare_record" "feedback_mx_record" {
+  count = (var.cloudflare_zone != null && var.mail_from_domain != null) ? 1 : 0
+
+  zone_id  = var.cloudflare_zone
+  name     = var.mail_from_domain
+  type     = "MX"
+  value    = "feedback-smtp.${var.region}.amazonaws.com"
+  priority = 10
+  proxied  = false
+  ttl      = 60
+}

aws/ses/locals.tf

@@ -0,0 +1,7 @@
+locals {
+  tags = {
+    Environment = var.environment
+    Project     = var.project
+    Domain      = var.domain
+  }
+}

aws/ses/main.tf

@@ -0,0 +1,32 @@
+resource "aws_ses_domain_identity" "domain" {
+  domain = var.ses_domain
+}
+
+resource "aws_ses_domain_dkim" "dkim" {
+  domain = aws_ses_domain_identity.domain.domain
+}
+
+data "aws_iam_policy_document" "ses_iam_policy" {
+  statement {
+    actions   = ["ses:*"]
+    resources = [aws_ses_domain_identity.domain.arn]
+  }
+}
+
+resource "aws_iam_policy" "main" {
+  name   = "${var.project}-${var.environment}-ses-full-access"
+  policy = data.aws_iam_policy_document.ses_iam_policy.json
+
+  tags = local.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_ses_domain_mail_from" "main" {
+  count                  = var.mail_from_domain != null ? 1 : 0
+  domain                 = aws_ses_domain_identity.domain.domain
+  mail_from_domain       = var.mail_from_domain
+  behavior_on_mx_failure = "UseDefaultValue"
+}

aws/ses/outputs.tf

@@ -0,0 +1,9 @@
+output "domain_identity_arn" {
+  description = "ARN of the SES domain identity"
+  value       = aws_ses_domain_identity.domain.arn
+}
+
+output "policy_arn" {
+  description = "ARN of the SES domain identity policy"
+  value       = aws_iam_policy.main.arn
+}

aws/ses/providers.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    cloudflare = {
+      source = "cloudflare/cloudflare"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.region
+}

aws/ses/route53.tf

@@ -0,0 +1,17 @@
+resource "aws_route53_record" "domain_amazonses_verification_record" {
+  count   = var.route53_zone != null ? 1 : 0
+  zone_id = var.route53_zone
+  name    = "_amazonses.${var.ses_domain}"
+  type    = "TXT"
+  ttl     = "3600"
+  records = [aws_ses_domain_identity.domain.verification_token]
+}
+
+resource "aws_route53_record" "domain_amazonses_dkim_record" {
+  count   = var.route53_zone != null ? 3 : 0
+  zone_id = var.route53_zone
+  name    = "${element(aws_ses_domain_dkim.dkim.dkim_tokens, count.index)}._domainkey.${var.ses_domain}"
+  type    = "CNAME"
+  ttl     = "3600"
+  records = ["${element(aws_ses_domain_dkim.dkim.dkim_tokens, count.index)}.dkim.amazonses.com"]
+}

aws/ses/variables.tf

@@ -0,0 +1,31 @@
+variable "environment" {}
+
+variable "project" {}
+
+variable "domain" {}
+
+variable "ses_domain" {}
+
+variable "region" {
+  type        = string
+  description = "AWS region for the SES domain verification"
+  default     = "us-east-1"
+}
+
+variable "route53_zone" {
+  type        = string
+  description = "Route 53 zone ID for the SES domain verification"
+  default     = null
+}
+
+variable "cloudflare_zone" {
+  type        = string
+  description = "Cloudflare zone ID for the SES domain verification"
+  default     = null
+}
+
+
+variable "mail_from_domain" {
+  default  = null
+  nullable = true
+}