Add AWS SES DKIM resource

aws/provider.go

@@ -425,6 +425,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_route_table_association":                  resourceAwsRouteTableAssociation(),
 			"aws_ses_active_receipt_rule_set":              resourceAwsSesActiveReceiptRuleSet(),
 			"aws_ses_domain_identity":                      resourceAwsSesDomainIdentity(),
+			"aws_ses_domain_dkim":                          resourceAwsSesDomainDkim(),
 			"aws_ses_receipt_filter":                       resourceAwsSesReceiptFilter(),
 			"aws_ses_receipt_rule":                         resourceAwsSesReceiptRule(),
 			"aws_ses_receipt_rule_set":                     resourceAwsSesReceiptRuleSet(),

aws/resource_aws_ses_domain_dkim.go

@@ -0,0 +1,89 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ses"
+	"github.com/hashicorp/terraform/helper/schema"
+)
+
+func resourceAwsSesDomainDkim() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsSesDomainDkimCreate,
+		Read:   resourceAwsSesDomainDkimRead,
+		Delete: resourceAwsSesDomainDkimDelete,
+
+		Schema: map[string]*schema.Schema{
+			"arn": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"domain": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"dkim_tokens": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+		},
+	}
+}
+
+func resourceAwsSesDomainDkimCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sesConn
+
+	domainName := d.Get("domain").(string)
+
+	createOpts := &ses.VerifyDomainDkimInput{
+		Domain: aws.String(domainName),
+	}
+
+	_, err := conn.VerifyDomainDkim(createOpts)
+	if err != nil {
+		return fmt.Errorf("Error requesting SES domain identity verification: %s", err)
+	}
+
+	d.SetId(domainName)
+
+	return resourceAwsSesDomainDkimRead(d, meta)
+}
+
+func resourceAwsSesDomainDkimRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).sesConn
+
+	domainName := d.Id()
+	d.Set("domain", domainName)
+
+	readOpts := &ses.GetIdentityDkimAttributesInput{
+		Identities: []*string{
+			aws.String(domainName),
+		},
+	}
+
+	response, err := conn.GetIdentityDkimAttributes(readOpts)
+	if err != nil {
+		log.Printf("[WARN] Error fetching identity verification attributes for %s: %s", d.Id(), err)
+		return err
+	}
+
+	verificationAttrs, ok := response.DkimAttributes[domainName]
+	if !ok {
+		log.Printf("[WARN] Domain not listed in response when fetching verification attributes for %s", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	d.Set("arn", fmt.Sprintf("arn:%s:ses:%s:%s:dkim/%s", meta.(*AWSClient).partition, meta.(*AWSClient).region, meta.(*AWSClient).accountid, d.Id()))
+	d.Set("dkim_tokens", verificationAttrs.DkimTokens)
+	return nil
+}
+
+func resourceAwsSesDomainDkimDelete(d *schema.ResourceData, meta interface{}) error {
+
+	return nil
+}

aws/resource_aws_ses_domain_dkim_test.go

@@ -0,0 +1,92 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/ses"
+	"github.com/hashicorp/terraform/helper/acctest"
+	"github.com/hashicorp/terraform/helper/resource"
+	"github.com/hashicorp/terraform/terraform"
+)
+
+func TestAccAwsSESDomainDkim_basic(t *testing.T) {
+	domain := fmt.Sprintf(
+		"%s.terraformtesting.com",
+		acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum))
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+		},
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: fmt.Sprintf(testAccAwsSESDomainDkimConfig, domain),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAwsSESDomainDkimExists("aws_ses_domain_dkim.test"),
+					testAccCheckAwsSESDomainDkimArn("aws_ses_domain_dkim.test", domain),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckAwsSESDomainDkimExists(n string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("SES Domain Identity not found: %s", n)
+		}
+
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("SES Domain Identity name not set")
+		}
+
+		domain := rs.Primary.ID
+		conn := testAccProvider.Meta().(*AWSClient).sesConn
+
+		params := &ses.GetIdentityDkimAttributesInput{
+			Identities: []*string{
+				aws.String(domain),
+			},
+		}
+
+		response, err := conn.GetIdentityDkimAttributes(params)
+		if err != nil {
+			return err
+		}
+
+		if response.DkimAttributes[domain] == nil {
+			return fmt.Errorf("SES Domain DKIM %s not found in AWS", domain)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAwsSESDomainDkimArn(n string, domain string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, _ := s.RootModule().Resources[n]
+
+		expected := fmt.Sprintf(
+			"arn:%s:ses:%s:%s:dkim/%s",
+			testAccProvider.Meta().(*AWSClient).partition,
+			testAccProvider.Meta().(*AWSClient).region,
+			testAccProvider.Meta().(*AWSClient).accountid,
+			domain)
+
+		if rs.Primary.Attributes["arn"] != expected {
+			return fmt.Errorf("Incorrect ARN: expected %q, got %q", expected, rs.Primary.Attributes["arn"])
+		}
+
+		return nil
+	}
+}
+
+const testAccAwsSESDomainDkimConfig = `
+resource "aws_ses_domain_dkim" "test" {
+	domain = "%s"
+}
+`

website/aws.erb

@@ -1279,6 +1279,10 @@
                             <a href="/docs/providers/aws/r/ses_domain_identity.html">aws_ses_domain_identity</a>
                         </li>
 
+                        <li<%= sidebar_current("docs-aws-resource-ses-domain-dkim") %>>
+                            <a href="/docs/providers/aws/r/ses_domain_dkim.html">aws_ses_domain_dkim</a>
+                        </li>
+
                         <li<%= sidebar_current("docs-aws-resource-ses-receipt-filter") %>>
                             <a href="/docs/providers/aws/r/ses_receipt_filter.html">aws_ses_receipt_filter</a>
                         </li>

website/docs/r/ses_domain_dkim.html.markdown

@@ -0,0 +1,48 @@
+---
+layout: "aws"
+page_title: "AWS: ses_domain_dkim"
+sidebar_current: "docs-aws-resource-ses-domain-dkim"
+description: |-
+  Provides an SES domain DKIM verification resource
+---
+
+# aws\_ses\_domain\_dkim
+
+Provides an SES domain DKIM verification resource
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `domain` - (Required) The domain name to verify to SES
+
+## Attributes Reference
+
+The following attributes are exported:
+
+* `arn` - The ARN of the domain dkim identity.
+
+* `dkim_tokens` - DKIM tokens generated by SES.
+  These tokens should be used to create CNAME records used to verify SES Easy DKIM.
+  See below for an example of how this might be achieved
+  when the domain is hosted in Route 53 and managed by Terraform. 
+  Find out more about verifying domains in Amazon SES 
+  in the [AWS SES docs](http://docs.aws.amazon.com/ses/latest/DeveloperGuide/easy-dkim-dns-records.html).
+
+## Example Usage
+
+```hcl
+resource "aws_ses_domain_dkim" "example" {
+  domain = "example.com"
+}
+
+resource "aws_route53_record" "example_amazonses_verification_record" {
+  count   = 3
+  zone_id = "ABCDEFGHIJ123"
+  name    = "${element(aws_ses_domain_dkim.example.dkim_tokens, count.index)}._domainkey.example.com"
+  type    = "CNAME"
+  ttl     = "600"
+  records = ["${element(aws_ses_domain_dkim.example.dkim_tokens, count.index)}.dkim.amazonses.com"]
+}
+```
+