feat: send IdP emails using SES SMTP server

[patheard]

Summary

Add SES configuration and an IAM user so that the IdP can send email using the SES SMTP server.

Also updates the database configuration to add connection pool settings as we are currently not using an RDS proxy to manage the connection pooling.

Related

• API: Identity Provider for request authentication platform-forms-client#3927
• Setup Zitadel Identity Provider in Staging platform-forms-client#3925

[github-actions]

⚠ Terrform update available

Terraform: 1.9.1 (using 1.6.6)
Terragrunt: 0.59.6 (using 0.54.8)

[github-actions]

Staging: idp

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 9 to add, 0 to change, 0 to destroy

Show summary

CHANGE	NAME
add	aws_iam_access_key.idp_send_email
	aws_iam_group.idp_send_email
	aws_iam_group_membership.idp_send_email
	aws_iam_group_policy_attachment.idp_send_email
	aws_iam_policy.idp_send_email
	aws_iam_user.idp_send_email
	aws_route53_record.idp_ses_verification_TXT
	aws_ses_domain_identity.idp
	aws_ses_domain_identity_verification.idp

Show plan

Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.idp_send_email will be read during apply
  # (config refers to values not yet known)
 <= data "aws_iam_policy_document" "idp_send_email" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "ses:SendRawEmail",
            ]
          + effect    = "Allow"
          + resources = [
              + (known after apply),
            ]
        }
    }

  # aws_iam_access_key.idp_send_email will be created
  + resource "aws_iam_access_key" "idp_send_email" {
      + create_date                    = (known after apply)
      + encrypted_secret               = (known after apply)
      + encrypted_ses_smtp_password_v4 = (known after apply)
      + id                             = (known after apply)
      + key_fingerprint                = (known after apply)
      + secret                         = (sensitive value)
      + ses_smtp_password_v4           = (sensitive value)
      + status                         = "Active"
      + user                           = "idp_send_email"
    }

  # aws_iam_group.idp_send_email will be created
  + resource "aws_iam_group" "idp_send_email" {
      + arn       = (known after apply)
      + id        = (known after apply)
      + name      = "idp_send_email"
      + path      = "/"
      + unique_id = (known after apply)
    }

  # aws_iam_group_membership.idp_send_email will be created
  + resource "aws_iam_group_membership" "idp_send_email" {
      + group = "idp_send_email"
      + id    = (known after apply)
      + name  = "idp_send_email"
      + users = [
          + "idp_send_email",
        ]
    }

  # aws_iam_group_policy_attachment.idp_send_email will be created
  + resource "aws_iam_group_policy_attachment" "idp_send_email" {
      + group      = "idp_send_email"
      + id         = (known after apply)
      + policy_arn = (known after apply)
    }

  # aws_iam_policy.idp_send_email will be created
  + resource "aws_iam_policy" "idp_send_email" {
      + arn         = (known after apply)
      + id          = (known after apply)
      + name        = "idp_send_email"
      + name_prefix = (known after apply)
      + path        = "/"
      + policy      = (known after apply)
      + policy_id   = (known after apply)
      + tags_all    = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
    }

  # aws_iam_user.idp_send_email will be created
  + resource "aws_iam_user" "idp_send_email" {
      + arn           = (known after apply)
      + force_destroy = false
      + id            = (known after apply)
      + name          = "idp_send_email"
      + path          = "/"
      + tags_all      = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + unique_id     = (known after apply)
    }

  # aws_route53_record.idp_ses_verification_TXT will be created
  + resource "aws_route53_record" "idp_ses_verification_TXT" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 600
      + type            = "TXT"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_ses_domain_identity.idp will be created
  + resource "aws_ses_domain_identity" "idp" {
      + arn                = (known after apply)
      + domain             = "auth.forms-staging.cdssandbox.xyz"
      + id                 = (known after apply)
      + verification_token = (known after apply)
    }

  # aws_ses_domain_identity_verification.idp will be created
  + resource "aws_ses_domain_identity_verification" "idp" {
      + arn    = (known after apply)
      + domain = (known after apply)
      + id     = (known after apply)
    }

Plan: 9 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_shield_protection.idp"]

22 tests, 19 passed, 3 warnings, 0 failures, 0 exceptions

[patheard]

These are all just best guesses at the moment. We'll need to tune them over time.

[craigzour]

LGTM!