add an email sender policy

src/constants/index.ts

@@ -1 +1,2 @@
+export * from "./regex-pattern";
 export * from "./stage";

src/constants/regex-pattern.test.ts

@@ -0,0 +1,28 @@
+import { RegexPattern } from "./regex-pattern";
+
+describe("the regex patterns", () => {
+  it("should successfully regex against valid ARNs", () => {
+    const regex = new RegExp(RegexPattern.ARN);
+    expect(regex.test("fooooo")).toBeFalsy();
+    expect(regex.test("arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1")).toBeTruthy();
+  });
+
+  it("should successfully regex against valid s3 ARNs only", () => {
+    const regex = new RegExp(RegexPattern.S3ARN);
+    expect(regex.test("fooooo")).toBeFalsy();
+    expect(regex.test("arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1")).toBeFalsy();
+    expect(regex.test("arn:aws:s3:::examplebucket/my-data/sales-export-2019-q4.json")).toBeTruthy();
+  });
+
+  it("should successfully regex against valid emails only", () => {
+    const regex = new RegExp(RegexPattern.GUARDIAN_EMAIL);
+    expect(regex.test("email.address.com")).toBeFalsy();
+    expect(regex.test("email@gmail.com")).toBeFalsy();
+
+    expect(regex.test("email@theguardian.com")).toBeTruthy();
+    expect(regex.test("another.email@theguardian.com")).toBeTruthy();
+
+    expect(regex.test("another.@theguardian.com")).toBeFalsy();
+    expect(regex.test("another1@theguardian.com")).toBeFalsy();
+  });
+});

src/constants/regex-pattern.ts

@@ -0,0 +1,12 @@
+const arnRegex = "arn:aws:[a-z0-9]*:[a-z0-9\\-]*:[0-9]{12}:.*";
+
+const s3BucketRegex = "(?!^(\\d{1,3}\\.){3}\\d{1,3}$)(^[a-z0-9]([a-z0-9-]*(\\.[a-z0-9])?)*$(?<!\\-))";
+const s3ArnRegex = `arn:aws:s3:::${s3BucketRegex}*`;
+
+const emailRegex = "^[a-zA-Z]+(\\.[a-zA-Z]+)*@theguardian.com$";
+
+export const RegexPattern = {
+  ARN: arnRegex,
+  S3ARN: s3ArnRegex,
+  GUARDIAN_EMAIL: emailRegex,
+};

src/constructs/core/parameters.test.ts

@@ -1,11 +1,10 @@
 import "@aws-cdk/assert/jest";
 import { SynthUtils } from "@aws-cdk/assert/lib/synth-utils";
 import { Stack } from "@aws-cdk/core";
-import { simpleGuStackForTesting } from "../../../test/utils/simple-gu-stack";
-import type { SynthedStack } from "../../../test/utils/synthed-stack";
+import { simpleGuStackForTesting } from "../../../test/utils";
+import type { SynthedStack } from "../../../test/utils";
 import { Stage, Stages } from "../../constants";
 import {
-  arnRegex,
   GuAmiParameter,
   GuArnParameter,
   GuInstanceTypeParameter,
@@ -16,7 +15,6 @@ import {
   GuStringParameter,
   GuSubnetListParameter,
   GuVpcParameter,
-  s3ArnRegex,
 } from "./parameters";
 import type { GuStack } from "./stack";
 
@@ -193,12 +191,6 @@ describe("The GuArnParameter class", () => {
       ConstraintDescription: "Must be a valid ARN, eg: arn:partition:service:region:account-id:resource-id",
     });
   });
-
-  it("should successfully regex against valid ARNs", () => {
-    const regex = new RegExp(arnRegex);
-    expect(regex.test("fooooo")).toBeFalsy();
-    expect(regex.test("arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1")).toBeTruthy();
-  });
 });
 
 describe("The GuS3ObjectArnParameter class", () => {
@@ -217,11 +209,4 @@ describe("The GuS3ObjectArnParameter class", () => {
         "Must be a valid S3 ARN, see https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html",
     });
   });
-
-  it("should successfully regex against valid s3 ARNs only", () => {
-    const regex = new RegExp(s3ArnRegex);
-    expect(regex.test("fooooo")).toBeFalsy();
-    expect(regex.test("arn:aws:rds:us-east-2:123456789012:db:my-mysql-instance-1")).toBeFalsy();
-    expect(regex.test("arn:aws:s3:::examplebucket/my-data/sales-export-2019-q4.json")).toBeTruthy();
-  });
 });

src/constructs/core/parameters.ts

@@ -1,6 +1,6 @@
 import type { CfnParameterProps } from "@aws-cdk/core";
 import { CfnParameter } from "@aws-cdk/core";
-import { Stage, Stages } from "../../constants";
+import { RegexPattern, Stage, Stages } from "../../constants";
 import type { GuStack } from "./stack";
 
 export type GuParameterProps = CfnParameterProps;
@@ -85,28 +85,33 @@ export class GuAmiParameter extends GuParameter {
   }
 }
 
-export const arnRegex = "arn:aws:[a-z0-9]*:[a-z0-9\\-]*:[0-9]{12}:.*";
-
 export class GuArnParameter extends GuStringParameter {
   constructor(scope: GuStack, id: string, props: GuNoTypeParameterProps) {
     super(scope, id, {
       ...props,
-      allowedPattern: arnRegex,
+      allowedPattern: RegexPattern.ARN,
       constraintDescription: "Must be a valid ARN, eg: arn:partition:service:region:account-id:resource-id",
     });
   }
 }
 
-const s3BucketRegex = "(?!^(\\d{1,3}\\.){3}\\d{1,3}$)(^[a-z0-9]([a-z0-9-]*(\\.[a-z0-9])?)*$(?<!\\-))";
-export const s3ArnRegex = `arn:aws:s3:::${s3BucketRegex}*`;
-
 export class GuS3ObjectArnParameter extends GuStringParameter {
   constructor(scope: GuStack, id: string, props: GuNoTypeParameterProps) {
     super(scope, id, {
       ...props,
-      allowedPattern: s3ArnRegex,
+      allowedPattern: RegexPattern.S3ARN,
       constraintDescription:
         "Must be a valid S3 ARN, see https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html",
     });
   }
 }
+
+export class GuGuardianEmailSenderParameter extends GuStringParameter {
+  constructor(scope: GuStack, id: string = "EmailSenderAddress", props?: GuNoTypeParameterProps) {
+    super(scope, id, {
+      ...props,
+      allowedPattern: RegexPattern.GUARDIAN_EMAIL,
+      constraintDescription: "Must be an @theguardian.com email address",
+    });
+  }
+}

src/constructs/iam/policies/__snapshots__/ses.test.ts.snap

@@ -0,0 +1,113 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`GuSESSenderPolicy should add a parameter to the stack for the sending email address 1`] = `
+Object {
+  "Parameters": Object {
+    "EmailSenderAddress": Object {
+      "AllowedPattern": "^[a-zA-Z]+(\\\\.[a-zA-Z]+)*@theguardian.com$",
+      "ConstraintDescription": "Must be an @theguardian.com email address",
+      "Type": "String",
+    },
+    "Stack": Object {
+      "Default": "deploy",
+      "Description": "Name of this stack",
+      "Type": "String",
+    },
+    "Stage": Object {
+      "AllowedValues": Array [
+        "CODE",
+        "PROD",
+      ],
+      "Default": "CODE",
+      "Description": "Stage name",
+      "Type": "String",
+    },
+  },
+  "Resources": Object {
+    "GuSESSenderPolicy2E2A75A2": Object {
+      "Properties": Object {
+        "PolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "ses:SendEmail",
+              "Effect": "Allow",
+              "Resource": Object {
+                "Fn::Join": Array [
+                  "",
+                  Array [
+                    "arn:aws:ses:",
+                    Object {
+                      "Ref": "AWS::Region",
+                    },
+                    ":",
+                    Object {
+                      "Ref": "AWS::AccountId",
+                    },
+                    ":identity/",
+                    Object {
+                      "Ref": "EmailSenderAddress",
+                    },
+                  ],
+                ],
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "GuSESSenderPolicy2E2A75A2",
+        "Roles": Array [
+          Object {
+            "Ref": "TestRole6C9272DF",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
+    "TestRole6C9272DF": Object {
+      "Properties": Object {
+        "AssumeRolePolicyDocument": Object {
+          "Statement": Array [
+            Object {
+              "Action": "sts:AssumeRole",
+              "Effect": "Allow",
+              "Principal": Object {
+                "Service": Object {
+                  "Fn::Join": Array [
+                    "",
+                    Array [
+                      "ec2.",
+                      Object {
+                        "Ref": "AWS::URLSuffix",
+                      },
+                    ],
+                  ],
+                },
+              },
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "Tags": Array [
+          Object {
+            "Key": "App",
+            "Value": "testing",
+          },
+          Object {
+            "Key": "Stack",
+            "Value": Object {
+              "Ref": "Stack",
+            },
+          },
+          Object {
+            "Key": "Stage",
+            "Value": Object {
+              "Ref": "Stage",
+            },
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Role",
+    },
+  },
+}
+`;

src/constructs/iam/policies/ses.test.ts

@@ -0,0 +1,48 @@
+import "@aws-cdk/assert/jest";
+import { SynthUtils } from "@aws-cdk/assert";
+import { attachPolicyToTestRole, simpleGuStackForTesting } from "../../../../test/utils";
+import { GuSESSenderPolicy } from "./ses";
+
+describe("GuSESSenderPolicy", () => {
+  it("should have a policy that reads from a parameter", () => {
+    const stack = simpleGuStackForTesting();
+    attachPolicyToTestRole(stack, new GuSESSenderPolicy(stack));
+
+    expect(stack).toHaveResource("AWS::IAM::Policy", {
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Action: "ses:SendEmail",
+            Effect: "Allow",
+            Resource: {
+              "Fn::Join": [
+                "",
+                [
+                  "arn:aws:ses:",
+                  {
+                    Ref: "AWS::Region",
+                  },
+                  ":",
+                  {
+                    Ref: "AWS::AccountId",
+                  },
+                  ":identity/",
+                  {
+                    Ref: "EmailSenderAddress",
+                  },
+                ],
+              ],
+            },
+          },
+        ],
+      },
+    });
+  });
+
+  it("should add a parameter to the stack for the sending email address", () => {
+    const stack = simpleGuStackForTesting();
+    attachPolicyToTestRole(stack, new GuSESSenderPolicy(stack));
+    expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
+  });
+});

src/constructs/iam/policies/ses.ts

@@ -0,0 +1,22 @@
+import { Effect, PolicyStatement } from "@aws-cdk/aws-iam";
+import type { GuStack } from "../../core";
+import { GuGuardianEmailSenderParameter } from "../../core";
+import type { GuPolicyProps } from "./base-policy";
+import { GuPolicy } from "./base-policy";
+
+export class GuSESSenderPolicy extends GuPolicy {
+  constructor(scope: GuStack, id: string = "GuSESSenderPolicy", props?: GuPolicyProps) {
+    super(scope, id, { ...props });
+
+    const emailSenderParam = new GuGuardianEmailSenderParameter(scope);
+
+    this.addStatements(
+      // see https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-authorization-policies.html
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["ses:SendEmail"],
+        resources: [`arn:aws:ses:${scope.region}:${scope.account}:identity/${emailSenderParam.valueAsString}`],
+      })
+    );
+  }
+}