Migrate to new email service

[adborden]

User Story

In order to gain more reliability into delivery of Data.gov's harvest report emails, agency data managers want data.gov to move to a new email service compatible with cloud.gov and non-GSA domains.

Acceptance Criteria

• GIVEN I run cf login -a api.fr.cloud.gov --sso and authenticate
  AND I run cf target -o gsa-datagov -s <development|staging|production>
  WHEN I run cf marketplace
  THEN I see an AWS SES service and plans listed
• GIVEN I run cf login -a api.fr.cloud.gov --sso and authenticate
  AND I run cf target -o gsa-datagov -s <development|staging|production>
  WHEN I run cf create-service csb-aws-ses common datagov-ses -p
  THEN I see the instance is running
  AND I can cf bind-service <app-name> <instance-name>
  AND I can see SMTP credentials for the AWS SES instance in cf env <app-name>
  AND I can see a successful mail delivery when I use those credentials for sending mail.

Background

#507

This could happen via a PR to csb-brokerpak-aws, but we need to weigh that route's compliance impact vs other options, if any.

Security Considerations (required)

This will be a new brokered service provided by the SSB. We will need to extend our SSP content to include SES wherever we already reference Solr.

Sketch

• Add a new service manifest (upstream docs) and terraform directory to csb-brokerpak-aws.
• Configure SES using the Terraform AWS provider.
  • Example of verifying DNS and certificates automatically using Terraform.
• Add tests for the new SES service
• Create new compliance diagrams for the SES service, based on the existing diagrams for the Solr service.
• Add the diagrams and necessary control narratives to the SSB SSP.

[adborden]

Adding that for cloud.gov we need a new email service anyway. This would cover more than just harvesting.

[adborden]

Just a reminder, production DNS for data.gov is still managed by GSA so I don't think we'll be able to automate much DKIM or SPF with terraform.

[FuhuXia]

Terraform part of this story is being addressed in this branch. https://github.com/FuhuXia/csb-brokerpak-aws/tree/aws-ses
The binding outputs include ses_smtp_server, ses_smtp_user, and ses_smtp_password.

ssb-dev.datagov.us is hard coded as a default domain, since that is the only domain I found available in the route53, no DKIM during the provisioning.

Next step will be releasing the brokerpak and trying it on cloud.gov.

[FuhuXia]

PR GSA/csb-brokerpak-aws#16 created.

[mogul]

I moved this back to In Progress until the .brokerpak is actually being deployed by the SSB.