Amazon SES でカスタムドメインを使用して受信したメールを S3 バケットに格納する構成を AWS CDK で実装してみた

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as route53 from 'aws-cdk-lib/aws-route53';
import * as ses from 'aws-cdk-lib/aws-ses';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as ses_actions from 'aws-cdk-lib/aws-ses-actions';
import * as cr from 'aws-cdk-lib/custom-resources';

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    const region = this.region;
    const domainName = process.env.DOMAIN_NAME || '';
    const noreplyEmailAddress = `noreply@${domainName}`;

    // 既存のホストゾーンを取得
    const hostedZone = route53.PublicHostedZone.fromLookup(this, 'HostedZone', {
      domainName,
    });

    // SES Domain Identity
    // MEMO: DKIM レコードの追加は既定で自動的に行われる
    new ses.EmailIdentity(this, 'SesEmailIdentity', {
      identity: ses.Identity.publicHostedZone(hostedZone),
    });

    // MXレコードの追加
    new route53.MxRecord(this, 'SESMXRecord', {
      zone: hostedZone,
      values: [
        {
          // @see https://docs.aws.amazon.com/general/latest/gr/ses.html#ses_inbound_endpoints
          hostName: `inbound-smtp.${region}.amazonaws.com`,
          priority: 10,
        },
      ],
      ttl: cdk.Duration.minutes(5),
    });

    // その他のレコードの追加は省略

    // 受信メール格納用バケット
    const incomingEmailBucket = new s3.Bucket(this, 'IncomingEmailBucket', {
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    // SES ルールセット
    // MEMO: ルールセットのアクティブ化は自動で行われない
    const ruleSet = new ses.ReceiptRuleSet(this, 'SESRuleSet', {
      rules: [
        {
          recipients: [noreplyEmailAddress],
          actions: [
            new ses_actions.S3({
              bucket: incomingEmailBucket,
              objectKeyPrefix: 'incoming/',
            }),
          ],
        },
      ],
    });

    // ルールセットをアクティブ化/非アクティブ化するカスタムリソース
    new cr.AwsCustomResource(this, 'SetActiveRuleSet', {
      onCreate: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {
          RuleSetName: ruleSet.receiptRuleSetName,
        },
        physicalResourceId: cr.PhysicalResourceId.of('SetActiveRuleSet'),
      },
      onUpdate: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {
          RuleSetName: ruleSet.receiptRuleSetName,
        },
        physicalResourceId: cr.PhysicalResourceId.of('SetActiveRuleSet'),
      },
      onDelete: {
        service: 'SES',
        action: 'setActiveReceiptRuleSet',
        parameters: {}, // 空のパラメータですべてのアクティブなルールセットを解除
      },
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });
  }
}

Subject: =?UTF-8?B?44OG44K544OI5Lu25ZCN?=
To: [email protected]
Content-Type: multipart/alternative; boundary="00000000000005de8d062572b44a"

--00000000000005de8d062572b44a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: base64

44OG44K544OI5pys5paHDQo=
--00000000000005de8d062572b44a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64

PGRpdiBkaXI9Imx0ciI+44OG44K544OI5pys5paHPC9kaXY+DQo=
--00000000000005de8d062572b44a--