From 3ad70175d8d66f90d69a2cf756cece545f4aafb5 Mon Sep 17 00:00:00 2001
From: "Aldo \"xoen\" Giambelluca" <aldo.giambelluca@digital.justice.gov.uk>
Date: Mon, 10 Sep 2018 14:42:13 +0100
Subject: [PATCH] Added SES SMTP user for Airflow

The `ses_smtp_user` can be used to create an IAM user with
permission to send emails from the specified SES Domain Identity.

NOTE: The SMTP password for the user is not specified but it's
an output of the IAM Access Key associated with the IAM user
---
 .../terraform/modules/ses_smtp_user/inputs.tf |  3 ++
 infra/terraform/modules/ses_smtp_user/main.tf | 28 +++++++++++++++++++
 .../modules/ses_smtp_user/outputs.tf          |  3 ++
 infra/terraform/platform/main.tf              |  8 ++++++
 infra/terraform/platform/outputs.tf           |  4 +++
 5 files changed, 46 insertions(+)
 create mode 100644 infra/terraform/modules/ses_smtp_user/inputs.tf
 create mode 100644 infra/terraform/modules/ses_smtp_user/main.tf
 create mode 100644 infra/terraform/modules/ses_smtp_user/outputs.tf

diff --git a/infra/terraform/modules/ses_smtp_user/inputs.tf b/infra/terraform/modules/ses_smtp_user/inputs.tf
new file mode 100644
index 000000000..4692095de
--- /dev/null
+++ b/infra/terraform/modules/ses_smtp_user/inputs.tf
@@ -0,0 +1,3 @@
+variable "ses_domain_identity_arn" {}
+
+variable "username" {}
diff --git a/infra/terraform/modules/ses_smtp_user/main.tf b/infra/terraform/modules/ses_smtp_user/main.tf
new file mode 100644
index 000000000..baa73224a
--- /dev/null
+++ b/infra/terraform/modules/ses_smtp_user/main.tf
@@ -0,0 +1,28 @@
+resource "aws_iam_user" "smtp_user" {
+  name = "${var.username}"
+}
+
+resource "aws_iam_access_key" "access_key" {
+  user = "${aws_iam_user.smtp_user.name}"
+}
+
+resource "aws_iam_user_policy" "smtp_user_policy" {
+  name = "${aws_iam_user.smtp_user.name}_policy"
+  user = "${aws_iam_user.smtp_user.name}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+        "Action": [
+            "ses:SendRawEmail",
+            "ses:SendEmail"
+        ],
+        "Effect": "Allow",
+        "Resource": "${var.ses_domain_identity_arn}"
+    }
+  ]
+}
+EOF
+}
diff --git a/infra/terraform/modules/ses_smtp_user/outputs.tf b/infra/terraform/modules/ses_smtp_user/outputs.tf
new file mode 100644
index 000000000..9102dff17
--- /dev/null
+++ b/infra/terraform/modules/ses_smtp_user/outputs.tf
@@ -0,0 +1,3 @@
+output "password" {
+  value = "${aws_iam_access_key.access_key.ses_smtp_password}"
+}
diff --git a/infra/terraform/platform/main.tf b/infra/terraform/platform/main.tf
index 9a7228c33..f8bd2f95b 100644
--- a/infra/terraform/platform/main.tf
+++ b/infra/terraform/platform/main.tf
@@ -120,6 +120,14 @@ module "airflow_db" {
   subnet_ids             = "${module.aws_vpc.storage_subnet_ids}"
 }
 
+module "airflow_smtp_user" {
+  source = "../modules/ses_smtp_user"
+
+  ses_domain_identity_arn = "${data.terraform_remote_state.base.xyz_root_domain_ses_identity_arn}"
+
+  username = "${terraform.workspace}_airflow_smtp_user"
+}
+
 module "cert_manager" {
   source           = "../modules/ec2_cert_manager_role"
   role_name        = "${terraform.workspace}-cert-manager"
diff --git a/infra/terraform/platform/outputs.tf b/infra/terraform/platform/outputs.tf
index 294b8ee92..63dce229f 100644
--- a/infra/terraform/platform/outputs.tf
+++ b/infra/terraform/platform/outputs.tf
@@ -6,6 +6,10 @@ output "airflow_efs_host" {
   value = "${module.airflow_storage_efs_volume.dns_name}"
 }
 
+output "airflow_smtp_password" {
+  value = "${module.airflow_smtp_user.password}"
+}
+
 output "control_panel_api_db_host" {
   value = "${module.control_panel_api.db_host}"
 }