feat: add SPF, DKIM and DMARC DNS records

[patheard]

Summary

Add email sending DNS records. The purpose of each is as follows:

• SPF: specify which servers are authorized to send emails on behalf of the IdP domain.

• DKIM: verify that an email message was not altered during transit and that it came from the claimed sender.

• DMARC: specify how emails that fail SPF or DKIM checks should be handled. A report with emails that fail the checks will be sent to [email protected]

Related

• Closes Add SPF, DKIM and DMARC DNS records for IdP platform-forms-client#3952

[github-actions]

⚠ Terrform update available

Terraform: 1.9.1 (using 1.6.6)
Terragrunt: 0.59.6 (using 0.54.8)

[github-actions]

Staging: idp

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 6 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_iam_policy.idp_send_email
add	aws_route53_record.idp_dkim_CNAME[0]
	aws_route53_record.idp_dkim_CNAME[1]
	aws_route53_record.idp_dkim_CNAME[2]
	aws_route53_record.idp_dmarc_TXT
	aws_route53_record.idp_spf_TXT
	aws_ses_domain_dkim.idp

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.idp_send_email will be updated in-place
  ~ resource "aws_iam_policy" "idp_send_email" {
        id        = "arn:aws:iam::687401027353:policy/idp_send_email"
        name      = "idp_send_email"
      ~ policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                          - "arn:aws:ses:ca-central-1:687401027353:identity/auth.forms-staging.cdssandbox.xyz",
                          - "arn:aws:ses:ca-central-1:687401027353:identity/[email protected]",
                        ] -> "arn:aws:ses:ca-central-1:687401027353:identity/auth.forms-staging.cdssandbox.xyz"
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags      = {}
        # (4 unchanged attributes hidden)
    }

  # aws_route53_record.idp_dkim_CNAME[0] will be created
  + resource "aws_route53_record" "idp_dkim_CNAME" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 300
      + type            = "CNAME"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_route53_record.idp_dkim_CNAME[1] will be created
  + resource "aws_route53_record" "idp_dkim_CNAME" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 300
      + type            = "CNAME"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_route53_record.idp_dkim_CNAME[2] will be created
  + resource "aws_route53_record" "idp_dkim_CNAME" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 300
      + type            = "CNAME"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_route53_record.idp_dmarc_TXT will be created
  + resource "aws_route53_record" "idp_dmarc_TXT" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "_dmarc.auth.forms-staging.cdssandbox.xyz"
      + records         = [
          + "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected]",
        ]
      + ttl             = 300
      + type            = "TXT"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_route53_record.idp_spf_TXT will be created
  + resource "aws_route53_record" "idp_spf_TXT" {
      + allow_overwrite = (known after apply)
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = "auth.forms-staging.cdssandbox.xyz"
      + records         = [
          + "v=spf1 include:amazonses.com -all",
        ]
      + ttl             = 300
      + type            = "TXT"
      + zone_id         = "Z05990652HOQ0SGHD81ZC"
    }

  # aws_ses_domain_dkim.idp will be created
  + resource "aws_ses_domain_dkim" "idp" {
      + dkim_tokens = (known after apply)
      + domain      = "auth.forms-staging.cdssandbox.xyz"
      + id          = (known after apply)
    }

Plan: 6 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.idp_send_email"]
WARN - plan.json - main - Missing Common Tags: ["aws_shield_protection.idp"]

22 tests, 19 passed, 3 warnings, 0 failures, 0 exceptions