SES メール受信 S3

data "aws_caller_identity" "current" {}

locals {
  domain    = "example.com"
}

resource "aws_ses_domain_identity" "this" {
  domain = local.domain
}

resource "aws_route53_zone" "this" {
  name = local.domain
}

resource "aws_route53_record" "ses_verification" {
  zone_id = aws_route53_zone.this.zone_id
  name    = "_amazonses.${local.domain}"
  type    = "TXT"
  ttl     = "300"
  records = [aws_ses_domain_identity.this.verification_token]
}

resource "aws_route53_record" "apex_mx" {
  zone_id = aws_route53_zone.this.zone_id
  name    = ""
  type    = "MX"
  ttl     = "60"
  records = ["10 inbound-smtp.ap-northeast-1.amazonaws.com"]
}

resource "aws_s3_bucket" "ses_rcpt_test" {
  bucket = "ses_rcpt_test"
}

resource "aws_s3_bucket_policy" "ses_s3_allow_put" {
  bucket = aws_s3_bucket.ses_rcpt_test.bucket

  policy = <<-EOF
{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Sid":"AllowSESPuts",
      "Effect":"Allow",
      "Principal":{
        "Service":"ses.amazonaws.com"
      },
      "Action":"s3:PutObject",
      "Resource":"arn:aws:s3:::${aws_s3_bucket.ses_rcpt_test.bucket}/*",
      "Condition":{
        "StringEquals":{
          "aws:Referer":"${data.aws_caller_identity.current.account_id}"
        }
      }
    }
  ]
}
EOF
}

resource "aws_ses_receipt_rule_set" "default" {
  rule_set_name = "default"
}

resource "aws_ses_receipt_rule" "ses_to_s3" {
  name          = "store"
  rule_set_name = aws_ses_receipt_rule_set.default.rule_set_name
  recipients    = ["ses-rcpt-test@example.com"]
  enabled       = true
  scan_enabled  = true

  s3_action {
    bucket_name = aws_s3_bucket.ses_rcpt_test.bucket
    position    = 2
  }
  depends_on = [aws_s3_bucket_policy.ses_s3_allow_put]
}

resource "aws_ses_active_receipt_rule_set" "default" {
  rule_set_name = aws_ses_receipt_rule_set.default.rule_set_name
}