AWS CDK で Amazon SES の Identity にメールアドレスを追加する

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as route53 from 'aws-cdk-lib/aws-route53';
import * as ses from 'aws-cdk-lib/aws-ses';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as ses_actions from 'aws-cdk-lib/aws-ses-actions';
import * as cr from 'aws-cdk-lib/custom-resources';

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    const region = this.region;
    const domainName = process.env.DOMAIN_NAME || '';
    const noreplyEmailAddress = `noreply@${domainName}`;

    // 既存のホストゾーンを取得
    const hostedZone = route53.PublicHostedZone.fromLookup(this, 'HostedZone', {
      domainName,
    });

    // SES Domain Identity
    // MEMO: DKIM レコードの追加は既定で自動的に行われる
    new ses.EmailIdentity(this, 'SesEmailIdentity', {
      identity: ses.Identity.publicHostedZone(hostedZone),
    });

    // MXレコードの追加
    new route53.MxRecord(this, 'SESMXRecord', {
      zone: hostedZone,
      values: [
        {
          // @see https://docs.aws.amazon.com/general/latest/gr/ses.html#ses_inbound_endpoints
          hostName: `inbound-smtp.${region}.amazonaws.com`,
          priority: 10,
        },
      ],
      ttl: cdk.Duration.minutes(5),
    });

    // その他のレコードの追加は省略

    // 受信メール格納用バケット
    const incomingEmailBucket = new s3.Bucket(this, 'IncomingEmailBucket', {
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    // SES ルールセット
    // MEMO: ルールセットのアクティブ化は自動で行われない
    const ruleSet = new ses.ReceiptRuleSet(this, 'SESRuleSet', {
      rules: [
        {
          recipients: [noreplyEmailAddress],
          actions: [
            new ses_actions.S3({
              bucket: incomingEmailBucket,
              objectKeyPrefix: 'incoming/',
            }),
          ],
        },
      ],
    });

    // ルールセットをアクティブ化/非アクティブ化するカスタムリソース
    new cr.AwsCustomResource(this, 'SetActiveRuleSet', {
      onCreate: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {
          RuleSetName: ruleSet.receiptRuleSetName,
        },
        physicalResourceId: cr.PhysicalResourceId.of('SetActiveRuleSet'),
      },
      onUpdate: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {
          RuleSetName: ruleSet.receiptRuleSetName,
        },
        physicalResourceId: cr.PhysicalResourceId.of('SetActiveRuleSet'),
      },
      onDelete: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {}, // 空のパラメータですべてのアクティブなルールセットを解除
      },
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });

    // noreplyEmailAddress の Email Identity への追加
    new ses.EmailIdentity(this, 'SesEmailIdentityNoreply', {
      identity: ses.Identity.email(noreplyEmailAddress),
    });
  }
}

Dear Amazon Web Services Customer,

We have received a request to authorize this email address for use with Amazon SES and Amazon Pinpoint in region Asia Pacific (Tokyo). If you requested this verification, please go to the following URL to confirm that you are authorized to use this email address:

https://email-verification.ap-northeast-1.amazonaws.com/?Context=.....

Your request will not be processed unless you confirm the address using this URL. This link expires 24 hours after your original verification request.

If you did NOT request to verify this email address, do not click on the link. Please note that many times, the situation isn't a phishing attempt, but either a misunderstanding of how to use our service, or someone setting up email-sending capabilities on your behalf as part of a legitimate service, but without having fully communicated the procedure first.

To learn more about sending email from Amazon Web Services, please refer to the Amazon SES Developer Guide at http://docs.aws.amazon.com/ses/latest/DeveloperGuide/Welcome.html and Amazon Pinpoint Developer Guide at http://docs.aws.amazon.com/pinpoint/latest/userguide/welcome.html.

Sincerely,

The Amazon Web Services Team.

$  npm run deploy

> [email protected] deploy
> cdk deploy --require-approval never --method=direct


✨  Synthesis time: 5.41s

Main: deploying... [1/1]
Main: updating stack...
5:17:52 PM | UPDATE_FAILED        | AWS::Cognito::UserPool       | MyUserPoolD09D1D74
Resource handler returned message: "Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified. The following identities failed the check in region AP-NORTHEAST-1: ar
n:aws:ses:ap-northeast-1:XXXXXXXXXXXX:identity/[email protected] (Service: CognitoIdentityProvider, Status Code: 400, Request ID: 7061cfbb-a6ff-4bb6-9382-b7fe47b22241)" (RequestToken: c57a9893-597f-de1
e-b300-54c21483eb48, HandlerErrorCode: InvalidRequest)

❌  Main failed: The stack named Main failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified. The following identities failed the check in region AP-NORTHEAST-1: arn:aws:ses:ap-northeast-1:XXXXXXXXXXXX:identity/[email protected] (Service: CognitoIdentityProvider, Status Code: 400, Request ID: 7061cfbb-a6ff-4bb6-9382-b7fe47b22241)" (RequestToken: c57a9893-597f-de1e-b300-54c21483eb48, HandlerErrorCode: InvalidRequest)