amadan

carlos / platform Public

region-host: optional ses:SendEmail grant for the console's own From

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Paul Campbell pushed by claude b82c42839e1d88855a61feb496abdd4917bd9dd6 parent 19c4796
2 files changed, +36 −0
  • infra/modules/region-host/main.tf +24 −0
  • infra/modules/region-host/variables.tf +12 −0
diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf
index b58458f7d..f2d159c83 100644
--- a/infra/modules/region-host/main.tf
+++ b/infra/modules/region-host/main.tf
@@ -696,6 +696,30 @@ resource "aws_iam_role_policy" "host_store" {
})
}
+# The console's own email (invite fallback, console-invite-delivery spec §4).
+# One identity, one From address. The configuration set and tenant are the
+# ops account's ("carlos-bab"), which SES checks on a tenant-attributed send.
+resource "aws_iam_role_policy" "host_console_mail" {
+ count = var.console_mail_from == "" ? 0 : 1
+ name = "${var.iam_name}-console-mail"
+ role = aws_iam_role.host.id
+ policy = jsonencode({
+ Version = "2012-10-17"
+ Statement = [{
+ Effect = "Allow"
+ Action = ["ses:SendEmail"]
+ Resource = [
+ "arn:aws:ses:${var.console_mail_region}:${data.aws_caller_identity.current.account_id}:identity/${split("@", var.console_mail_from)[1]}",
+ "arn:aws:ses:${var.console_mail_region}:${data.aws_caller_identity.current.account_id}:configuration-set/carlos-bab",
+ "arn:aws:ses:${var.console_mail_region}:${data.aws_caller_identity.current.account_id}:tenant/carlos-bab/*",
+ ]
+ Condition = {
+ StringEquals = { "ses:FromAddress" = var.console_mail_from }
+ }
+ }]
+ })
+}
+
# ---- object storage scanning (opt-in) --------------------------------------
#
# The one grant that lets this role read tenant object bytes, so it is its own
diff --git a/infra/modules/region-host/variables.tf b/infra/modules/region-host/variables.tf
index dfdd197c9..ae1e4258e 100644
--- a/infra/modules/region-host/variables.tf
+++ b/infra/modules/region-host/variables.tf
@@ -217,3 +217,15 @@ variable "relay" {
type = bool
default = false
}
+
+variable "console_mail_from" {
+ description = "The console's own From address (CARLOS_CONSOLE_MAIL_FROM, or noreply@console.bab.<platform suffix>). Empty: the host role gets no ses:SendEmail and the console sends no email of its own."
+ type = string
+ default = ""
+}
+
+variable "console_mail_region" {
+ description = "SES region the console sends from (CARLOS_MAIL_REGION). Required when console_mail_from is set."
+ type = string
+ default = ""
+}