Cấu hình AWS SES gửi email về Gmail bằng Terraform

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
  backend "s3" {
    bucket = "<điền tên bucket của bạn vào đây>"
    key    = "ses-gmail-custom-domain/terraform.tfstate"
    region = "us-east-1"
  }
}

## Danh tính miền SES
resource "aws_ses_domain_identity" "identity" {
  domain = var.domain_name
}

## Cấu hình DKIM cho danh tính miền SES
resource "aws_ses_domain_dkim" "dkim" {
  domain = aws_ses_domain_identity.identity.domain
}

## Xác minh quyền sở hữu miền SES -> miền tùy chỉnh
resource "aws_route53_record" "amazonses_identity_verification_record" {
  zone_id = data.aws_route53_zone.hosted_zone.id
  name    = "_amazonses.${var.domain_name}"
  type    = "TXT"
  ttl     = "600"
  records = [aws_ses_domain_identity.identity.verification_token]
}

## Bản ghi DKIM cho danh tính miền SES
resource "aws_route53_record" "amazonses_identity_dkim_records" {
  for_each = toset(aws_ses_domain_dkim.dkim.dkim_tokens)
  zone_id = data.aws_route53_zone.hosted_zone.id
  name    = "${each.key}._domainkey.${aws_ses_domain_identity.identity.domain}"
  type    = "CNAME"
  ttl     = 600
  records = ["${each.key}.dkim.amazonses.com"]
}

## Bản ghi MX trỏ tới máy chủ SES
resource "aws_route53_record" "mx_record" {
  zone_id = data.aws_route53_zone.hosted_zone.id
  name    = data.aws_route53_zone.hosted_zone.name
  type    = "MX"
  ttl     = 600
  records = ["10 inbound-smtp.${var.region}.amazonaws.com"]
}

## Bản ghi SPF cho phép amazonses.com gửi email thay mặt cho miền của bạn
resource "aws_route53_record" "spf_record" {
  zone_id = data.aws_route53_zone.hosted_zone.id
  name    = data.aws_route53_zone.hosted_zone.name
  type    = "TXT"
  ttl     = 600
  records = ["v=spf1 include:amazonses.com -all"]
}

## Bản ghi DMARC
resource "aws_route53_record" "dmarc_record" {
  zone_id = data.aws_route53_zone.hosted_zone.id
  name    = "_dmarc.${data.aws_route53_zone.hosted_zone.name}"
  type    = "TXT"
  ttl     = 600
  records = ["v=DMARC1; p=none;"]
}

## Bucket S3 cho email đến
resource "aws_s3_bucket" "incoming_email_bucket" {
  bucket = "ses-inbox-${var.author}"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "encryption" {
  bucket = aws_s3_bucket.incoming_email_bucket.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.incoming_email_bucket.id

  lambda_function {
    lambda_function_arn = aws_lambda_function.lambda_forwarder.arn
    events              = ["s3:ObjectCreated:*"]
  }

  depends_on = [aws_lambda_permission.s3_bucket_event]
}

## Hàm Lambda chuyển tiếp email
data "archive_file" "lambda_zip" {
  output_path = "lambda.zip"
  type        = "zip"
  source_dir  = "lambda-forwarder-source-code"
}

resource "aws_iam_role" "lambda_role" {
  name_prefix        = "ses-email-forwarder-role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "lambda_policy" {
  name_prefix = "ses-email-forwarder-role-policy"
  policy = jsonencode(
    {
      Version : "2012-10-17",
      Statement : [
        {
          "Effect" : "Allow",
          "Action" : [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
            ], Resource : [
            "*"
          ]
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "s3:GetObject"
          ],
          "Resource" : [
            "${aws_s3_bucket.incoming_email_bucket.arn}/*"
          ]
        },
        {
          "Effect" : "Allow",
          "Action" : [
            "ses:SendEmail",
            "ses:SendRawEmail"
          ],
          "Resource" : "*"
        }
      ]
  })
  role = aws_iam_role.lambda_role.id
}

resource "aws_lambda_function" "lambda_forwarder" {
  filename         = "lambda.zip"
  function_name    = "ses-email-forwarder"
  role             = aws_iam_role.lambda_role.arn
  handler          = "lambda.lambda_handler"
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  runtime          = "python3.9"
  environment {
    variables = {
      REGION     = var.region
      FORWARD_TO = var.original_email
      DOMAIN     = var.domain_name
    }
  }
}

resource "aws_lambda_permission" "s3_bucket_event" {
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_forwarder.arn
  principal     = "s3.amazonaws.com"
  statement_id  = "event_permissions_from_${aws_s3_bucket.incoming_email_bucket.bucket}"
  source_arn    = aws_s3_bucket.incoming_email_bucket.arn
}

output "ses_smtp_server" {
  value = "email-smtp.${var.region}.amazonaws.com" ## kiểm tra trong cài đặt SES -> SMTP
}

output "ses_smtp_server_port" {
  value = "587"
}

## Thông tin xác thực người dùng SMTP sẽ được sử dụng bên phía Gmail để gửi email thay mặt cho SES
output "ses_smtp_user_username" {
  value = nonsensitive(aws_iam_access_key.ses_smtp_access_key.id) # chỉ để thử nghiệm, không nên sử dụng trong môi trường sản xuất
}

output "ses_smtp_user_password" {
  value = nonsensitive(aws_iam_access_key.ses_smtp_access_key.ses_smtp_password_v4) # chỉ để thử nghiệm, không nên sử dụng trong môi trường sản xuất
}