adding permissions

- Allowing SES to use CMK for SNS topic through resource policy
HicResearch · May 26, 2022 · b56433f · b56433f
1 parent 3df7567
commit b56433f
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/src/components/egress_app_backend/egress_backend/egress_backend_stack.py b/src/components/egress_app_backend/egress_backend/egress_backend_stack.py
@@ -162,6 +162,22 @@ def __init__(
             )
         )
 
+        sns_kms_key.add_to_resource_policy(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                principals=[
+                    iam.ServicePrincipal("ses.amazonaws.com"),
+                ],
+                resources=[
+                    "*",
+                ],
+                actions=[
+                    "kms:GenerateDataKey*",
+                    "kms:Decrypt",
+                ],
+            )
+        )
+
         # Custom resource to handle email identity verification
         ses_sender_email_verification = EmailIdentityVerificationCustomResource(
             self,