Skip navigation links

Package software.amazon.awscdk.services.ses

Amazon Simple Email Service Construct Library

See: Description

Package software.amazon.awscdk.services.ses Description

Amazon Simple Email Service Construct Library

This module is part of the AWS Cloud Development Kit project.

Email receiving

Create a receipt rule set with rules and actions (actions can be found in the @aws-cdk/aws-ses-actions package): 

 import software.amazon.awscdk.services.s3.*;
 import software.amazon.awscdk.services.ses.actions.*;
 
 
 Bucket bucket = new Bucket(this, "Bucket");
 Topic topic = new Topic(this, "Topic");
 
 ReceiptRuleSet.Builder.create(this, "RuleSet")
         .rules(List.of(ReceiptRuleOptions.builder()
                 .recipients(List.of("hello@aws.com"))
                 .actions(List.of(
                     AddHeader.Builder.create()
                             .name("X-Special-Header")
                             .value("aws")
                             .build(),
                     S3.Builder.create()
                             .bucket(bucket)
                             .objectKeyPrefix("emails/")
                             .topic(topic)
                             .build()))
                 .build(), ReceiptRuleOptions.builder()
                 .recipients(List.of("aws.com"))
                 .actions(List.of(
                     Sns.Builder.create()
                             .topic(topic)
                             .build()))
                 .build()))
         .build();

Alternatively, rules can be added to a rule set: 

 ReceiptRuleSet ruleSet = new ReceiptRuleSet(this, "RuleSet");
 
 ReceiptRule awsRule = ruleSet.addRule("Aws", ReceiptRuleOptions.builder()
         .recipients(List.of("aws.com"))
         .build());

And actions to rules: 

 import software.amazon.awscdk.services.ses.actions.*;
 
 ReceiptRule awsRule;
 Topic topic;
 
 awsRule.addAction(Sns.Builder.create()
         .topic(topic)
         .build());

When using addRule, the new rule is added after the last added rule unless after is specified.

Drop spams

A rule to drop spam can be added by setting dropSpam to true: 

 ReceiptRuleSet.Builder.create(this, "RuleSet")
         .dropSpam(true)
         .build();

This will add a rule at the top of the rule set with a Lambda action that stops processing messages that have at least one spam indicator. See Lambda Function Examples.

Receipt filter

Create a receipt filter: 

 ReceiptFilter.Builder.create(this, "Filter")
         .ip("1.2.3.4/16")
         .build();

An allow list filter is also available: 

 AllowListReceiptFilter.Builder.create(this, "AllowList")
         .ips(List.of("10.0.0.0/16", "1.2.3.4/16"))
         .build();

This will first create a block all filter and then create allow filters for the listed ip addresses.

Email sending

Dedicated IP pools

When you create a new Amazon SES account, your emails are sent from IP addresses that are shared with other Amazon SES users. For an additional monthly charge, you can lease dedicated IP addresses that are reserved for your exclusive use.

Use the DedicatedIpPool construct to create a pool of dedicated IP addresses: 

 new DedicatedIpPool(this, "Pool");

The pool can then be used in a configuration set.

Configuration sets

Configuration sets are groups of rules that you can apply to your verified identities. A verified identity is a domain, subdomain, or email address you use to send email through Amazon SES. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.

Use the ConfigurationSet construct to create a configuration set: 

 IDedicatedIpPool myPool;
 
 
 ConfigurationSet.Builder.create(this, "ConfigurationSet")
         .customTrackingRedirectDomain("track.cdk.dev")
         .suppressionReasons(SuppressionReasons.COMPLAINTS_ONLY)
         .tlsPolicy(ConfigurationSetTlsPolicy.REQUIRE)
         .dedicatedIpPool(myPool)
         .build();

Email identity

In Amazon SES, a verified identity is a domain or email address that you use to send or receive email. Before you can send an email using Amazon SES, you must create and verify each identity that you're going to use as a From, Source, Sender, or Return-Path address. Verifying an identity with Amazon SES confirms that you own it and helps prevent unauthorized use.

To verify an identity for a hosted zone, you create an EmailIdentity: 

 // Example automatically generated from non-compiling source. May contain errors.
 IPublicHostedZone myHostedZone;
 
 
 EmailIdentity identity = EmailIdentity.Builder.create(stack, "Identity")
         .identity(Identity.publicHostedZone(myHostedZone))
         .mailFromDomain("mail.cdk.dev")
         .build();

By default, Easy DKIM with a 2048-bit DKIM key is used.

You can instead configure DKIM authentication by using your own public-private key pair. This process is known as Bring Your Own DKIM (BYODKIM): 

 // Example automatically generated from non-compiling source. May contain errors.
 IPublicHostedZone myHostedZone;
 
 
 EmailIdentity.Builder.create(stack, "Identity")
         .identity(Identity.publicHostedZone(myHostedZone))
         .dkimIdentity(DkimIdentity.byoDkim(Map.of(
                 "privateKey", SecretValue.secretsManager("dkim-private-key"),
                 "publicKey", "...base64-encoded-public-key...",
                 "selector", "selector")))
         .build();

When using publicHostedZone() for the identity, all necessary Amazon Route 53 records are created automatically:

When working with domain(), records must be created manually: 

 // Example automatically generated from non-compiling source. May contain errors.
 EmailIdentity identity = EmailIdentity.Builder.create(stack, "Identity")
         .identity(Identity.domain("cdk.dev"))
         .build();
 
 for (Object record : identity.getDkimRecords()) {
 }
Skip navigation links

Copyright © 2022. All rights reserved.