Usage#

AWS SES is an SMTP/SMTPS service provided by Amazon. Amazon provides one uniques SES instance per region and per account.

To be able to use the SES API you can retrieve AKSK from infra zones Vault server: Example for NGOT SES Instance.

export VAULT_ADDR=https://vault.infra-stg.caascad.com
eval $(vault read aws/sts/ngot-power-user -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_SESSION_TOKEN=\(.security_token)"')

# export the AWS SES instance region
export AWS_DEFAULT_REGION="eu-west-1"

Sandbox mode#

By default AWS SES runs in sandbox mode. Quotas are very low and sending emails is only possible through verified emails. To run SES in productin mode, an AWS support ticket is required. It can be issued from the AWS SES console.

Domain identities#

AWS SES requires to add Domain Identities (DNS domain) to be able to send emails for that domain. Adding a domain identity requires to verify that identity. This automatically done with the aws_ses terraform configuration which will retrieve verification dns records and add them to the mail dns domain.

To list identities:

aws ses list-identities

{
    "Identities": [
        "cloudservicesfactory.com",
        "csfpriv.com"
    ]
}

Email identities#

It is also possible to create verified emails via an email verification process. It allows to send emails from a given verified address. It is only necessary to add verified emails to SES when the ses instance is in sandbox mode.

SMTP authentication#

To be able to send mails through SMTP, authentication is required. The aws_ses terraform configuration will create that secret and store it in infra zones Vault server

vault read secret/aws/smtp      # Caascad SMTP secret
vault read secret/aws/smtp-ngot # NGOT SMTP secret

Testing SES#

With a verified email or a SES instance in production mode it is possible to test the SMTP interface

eval $(vault read aws/sts/smtp-ngot -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_HOST=\(.host)"')
SMTP_Username=$(echo -n "${AWS_ACCESS_KEY_ID}" | openssl enc -base64)
SMTP_Password=$(echo -n "${AWS_SECRET_ACCESS_KEY}" | openssl enc -base64)

cat<EOF>/tmp/smtp.message
EHLO csfpriv.com
AUTH LOGIN
${SMTP_Username}
${SMTP_Password}
MAIL FROM: noreply@csfpriv.com
RCPT TO: support.caascad@orange.com
DATA
From: Me <noreply@csfpriv.com>
To: support.caascad@orange.com
Subject: Amazon SES SMTP Test

This message was sent using the Amazon SES SMTP interface.
.
QUIT

EOF

openssl s_client -crlf -quiet -starttls smtp -connect ${AWS_HOST}:587 < /tmp/smtp.message # Explicit TLS
openssl s_client -crlf -quiet -connect ${AWS_HOST}:465 < /tmp.message # Implicit TLS

# SES will answer a message like this:
# 250 Ok 01010160d7de98d8-21e57d9a-JZho-416c-bbe1-8ebaAexample-000000