template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: An AWS Serverless app that stores and syncs incoming SES mail to an IMAP mailbox
Parameters:
  LoftDomain:
    Type: String
    Description: Domain name on which to receive email in SES (e.g. 'example.com')
  IMAPServer:
    Type: String
    Description: Host name of an IMAP server to which Loft will connect and synchronise messages
  IMAPUsername:
    Type: String
    NoEcho: true
  IMAPPassword:
    Type: String
    NoEcho: true
  
  IMAPDestinationFolder:
    Type: String
    Default: "INBOX"
    Description: Only change this if you know what you're doing. Default is 'INBOX'
  IMAPMarkAsRead: 
    Type: String
    Description: Set to 'true' to avoid unread messages once they are stored in the mailbox
    AllowedValues:
      - 'true'
      - 'false'
    Default: false
  IMAPDebugLogging:
    Type: String
    Description: Set to 'true' to write diagnostic information about the IMAP connection to CloudWatch logs
    AllowedValues:
      - 'true'
      - 'false'
    Default: false
  
Metadata:
  AWS::ServerlessRepo::Application:
    Name: Loft
    Description: |
      Receive email via Amazon Simple Email Service (SES) 
      on a wildcard domain (<anything>@yourdomain.com) 
      and synchronise it to a designated IMAP mailbox.
    Labels: 
      - mail
      - email
      - imap
      - lambda
      - ses
    Author: Barry Postma
    SemanticVersion: 1.3.1
    ReadmeUrl: ./README.md
    SpdxLicenseId: MIT
    LicenseUrl: ./LICENSE
    HomePageUrl: https://github.com/BAPostma/Loft
    SourceCodeUrl: https://github.com/BAPostma/Loft

Resources:
  EmailStorage:
    Type: AWS::S3::Bucket
    Properties: 
      BucketName: !Join ['-', ['loft', !Ref LoftDomain]]
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      AccessControl: Private

  EmailStoragePermissions:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref EmailStorage
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
            Effect: Allow
            Resource: !Join ['', ['arn:aws:s3:::', !Ref EmailStorage, '/*']]
            Principal:
              Service: 
                - 'ses.amazonaws.com'
            Condition:
              StringLike:
                'aws:Referer':
                  - !Ref AWS::AccountId
    DependsOn: EmailStorage

  EmailNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Join ['-', ['sns', Fn::Join: ['_', Fn::Split: ['.', !Ref LoftDomain]], 'inbox']]
    DependsOn:
      - EmailNotificationQueue

  EmailNotificationQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Join ['-', ['sqs', Fn::Join: ['_', Fn::Split: ['.', !Ref LoftDomain]], 'inbox']]
      MessageRetentionPeriod: 1209600
      RedrivePolicy: 
        deadLetterTargetArn: !GetAtt EmailNotificationDeadLetterQueue.Arn
        maxReceiveCount: 3
      VisibilityTimeout: 60
    DependsOn: EmailNotificationDeadLetterQueue

  EmailNotificationQueueTopicSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: sqs
      TopicArn: !Ref EmailNotificationTopic
      Endpoint: !GetAtt EmailNotificationQueue.Arn
      RawMessageDelivery: true
    DependsOn:
      - EmailNotificationTopic
      - EmailNotificationQueue

  EmailNotificationDeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Join ['-', ['sqs', Fn::Join: ['_', Fn::Split: ['.', !Ref LoftDomain]], 'dlq']]
      MessageRetentionPeriod: 1209600
  
  CommandsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Join ['-', ['sqs', Fn::Join: ['_', Fn::Split: ['.', !Ref LoftDomain]], 'commands']]
      MessageRetentionPeriod: 1209600
      RedrivePolicy: 
        deadLetterTargetArn: !GetAtt EmailNotificationDeadLetterQueue.Arn
        maxReceiveCount: 3
      VisibilityTimeout: 180
    DependsOn: EmailNotificationDeadLetterQueue

  EmailNotificationQueuePermissions:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref EmailNotificationQueue
      PolicyDocument:
        Statement:
          - Action:
              - 'SQS:SendMessage'
            Effect: Allow
            Resource: !GetAtt EmailNotificationQueue.Arn
            Principal:
              AWS: '*'
            Condition:
              ArnLike:
                'aws:SourceArn':
                  - !Ref EmailNotificationTopic
    DependsOn: EmailNotificationQueue

  EmailReceiver:
    Type: AWS::SES::ReceiptRuleSet
    Properties:
      RuleSetName: !Join ['-', ['loft', !Ref LoftDomain, 'rule-set']]

  EmailReceiverCatchAllRule:
    Type: AWS::SES::ReceiptRule
    Properties:
      RuleSetName: !Join ['-', ['loft', !Ref LoftDomain, 'rule-set']]
      Rule:
        Name: !Join ['-', [!Ref LoftDomain, 'catch-all']]
        Enabled: true
        ScanEnabled: true
        Recipients:
          - !Ref LoftDomain
        Actions:
          - S3Action:
              BucketName: !Ref EmailStorage
              ObjectKeyPrefix: 'inbox/'
              TopicArn: !Ref EmailNotificationTopic
          - StopAction:
              Scope: RuleSet
    DependsOn: 
      - EmailReceiver
      - EmailStorage
      - EmailStoragePermissions
      - EmailNotificationTopic
  
  EmailHandlerExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['', ['Custom.AWS.Lambda.Loft-', !Ref LoftDomain]]
      Description: Loft email handler lambda execution role
      ManagedPolicyArns:
       - arn:aws:iam::aws:policy/AWSLambda_FullAccess
       - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
       - arn:aws:iam::aws:policy/AmazonS3FullAccess
       - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Join ['', ['Custom.AWS.SQS.ReceiveMessage-', !Ref LoftDomain]]
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - sqs:DeleteMessage
                  - sqs:GetQueueUrl
                  - sqs:ListDeadLetterSourceQueues
                  - sqs:SendMessage
                  - sqs:ReceiveMessage
                  - sqs:GetQueueAttributes
                  - sqs:ListQueueTags
                Resource: "*"

  EmailHandler:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: Loft.Function::Loft.Function.LambdaFunction::FunctionHandler
      Runtime: dotnet6
      CodeUri: ./src/Loft.Function
      Description: 'Stores and syncs incoming SES mail to an IMAP mailbox'
      MemorySize: 128
      Timeout: 60
      Role: !GetAtt EmailHandlerExecutionRole.Arn
      DeadLetterQueue: 
        TargetArn: !GetAtt EmailNotificationDeadLetterQueue.Arn
        Type: SQS
      Events:
        SQSTrigger:
          Type: SQS
          Properties:
            Queue: !GetAtt EmailNotificationQueue.Arn
      Environment:
        Variables:
          LoftDomain: !Ref LoftDomain
          DynamoDbTableName: !Ref EmailTable
          IMAPServer: !Ref IMAPServer
          IMAPUsername: !Ref IMAPUsername
          IMAPPassword: !Ref IMAPPassword
          IMAPDestinationFolder: !Ref IMAPDestinationFolder
          IMAPMarkAsRead: !Ref IMAPMarkAsRead
          IMAPDebugLogging: !Ref IMAPDebugLogging
    DependsOn:
      - EmailHandlerExecutionRole
      - EmailTable
      - EmailNotificationQueue
      - EmailNotificationDeadLetterQueue

  CommandsHandler:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: Loft.Function::Loft.Function.ControlFunction::CommandHandler
      Runtime: dotnet6
      CodeUri: ./src/Loft.Function
      Description: 'Executes commands as they are submitted into a special queue'
      MemorySize: 256
      Timeout: 180
      Role: !GetAtt EmailHandlerExecutionRole.Arn
      Events:
        SQSTrigger:
          Type: SQS
          Properties:
            Queue: !GetAtt CommandsQueue.Arn
      Environment:
        Variables:
          DynamoDbTableName: !Ref EmailTable
    DependsOn:
      - EmailHandlerExecutionRole
      - EmailTable
      - CommandsQueue
      - EmailNotificationDeadLetterQueue
  
  EmailTable:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Join ['-', ['loft', Fn::Join: ['_', Fn::Split: ['.', !Ref LoftDomain]]]]
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
        - AttributeName: timestamp
          AttributeType: S
        - AttributeName: source
          AttributeType: S
        - AttributeName: destination
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
        - AttributeName: timestamp
          KeyType: RANGE
      GlobalSecondaryIndexes:
        - IndexName: source-address-index
          KeySchema:
            - AttributeName: source
              KeyType: HASH
          Projection:
            ProjectionType: ALL
        - IndexName: destination-address-index
          KeySchema:
            - AttributeName: destination
              KeyType: HASH
          Projection:
            ProjectionType: ALL