SES service

Introduction

The SES service is a the AWS SMTP service. As Route53 there is no need to instantiate it. AWS creates one SES service per account/region. By default the instance is in sandbox mode, with low rate limiting and ability to send mails from verified emails. In production mode, the rate limiting is higher by far and all MAIL_FROM coming from a verified domain are accepted.

Use cases

We send mails for the following cases: * reset password by mail for keycloak * sending alerts via alertmanager * creating pseudo mailbox for new aws accounts managed by us (a unique mail is required to create an account on an organization)

Provisioning

SES provisioning is done through 2 terraform configurations: * aws_ses: add domain, smtp credentials, verifications records, etc... * aws_ses_rules: add incoming rules.

Beware SES incoming rules are available only on few AWS regions. It is only used by Caascad and is probably unnecessary.

The configuration will require aws roles for route53, iam, and ses. All of them are created by aws_account_bootstrap.

Caascad

On Caascad we have 2 separate SES instances on eu-west-1. * One managed by infra-stg on Caascad AWS Account * One managed by infra-prd on Caascad Prod AWS Account

NGOT

On NGOT we have a common instance for every line on the NGOT account. We just add domain identities to the instance.