Generated SES SMTP password does not work

[jait]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

$ terraform -v
Terraform v0.12.13
+ provider.archive v1.2.2
+ provider.aws v2.29.0
+ provider.random v2.2.0
+ provider.template v2.1.2

Affected Resource(s)

• aws_iam_access_key

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp
resource "aws_iam_user" "ses-smtp" {
  name = "ses-smtp-user"
}

resource "aws_iam_user_policy" "ses-smtp" {
  name = "AmazonSesSendingAccess"
  user = aws_iam_user.ses-smtp.name
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ses:SendRawEmail",
            "Resource": "*"
        }
    ]
}
EOF
}

resource "aws_iam_access_key" "ses-smtp" {
  user    = aws_iam_user.ses-smtp.name
  pgp_key = var.pgp_key
}

Expected Behavior

Generated SES SMTP password (aws_iam_access_key.ses-smtp.ses_smtp_password) works.

Actual Behavior

The password is generated but is not valid for SES SMTP login.

Steps to Reproduce

1. terraform apply

Important Factoids

Running on region eu-central-1.
When I generated the SMTP password using Amazon's code sample at https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html, it works. The password generated by Terraform doesn't. Please note that Terraform generates passwords with version 0x02 whereas Amazon's sample is with version 0x04. The sample code doesn't accept eu-central-1 but it is trivial to add.

References

[tsrivishnu]

As a temporary solution, I used the python script from AWS documentation on this topic to generate the SMTP password using the secret from aws_iam_access_key resource.

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html#smtp-credentials-convert

You might want to add more regions into the python code's --region argument to support accept them

[bflad]

Support for generating SES SMTP v4 passwords into a new ses_smtp_password_v4 attribute has been merged and will release with version 2.50.0 of the Terraform AWS Provider. Thanks to @n3ph for the implementation. 👍

Please note: The password value is region-specific to the provider region of the aws_iam_access_key resource. To work across multiple regions, separate resources are necessary.

[ghost]

This has been released in version 2.50.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!