How can I generate AWS SES SMTP credentials using the CDK?

Question

There is a manual on how to obtain SMTP credentials using GUI:

Obtaining Amazon SES SMTP credentials using the Amazon SES console

Is there a way to achieve this using Amazon CDK? So far, I've tried using aws-ses package with zero luck.

I don't expect you to write the code for me, just point me to the right direction.

Describing a workflow will do just fine, thanks.

Answer 1

Obtaining Amazon SES SMTP credentials requires the below IAM policies per the docs :

Your IAM policy must allow you to perform the following IAM actions: iam:ListUsers , iam:CreateUser , iam:CreateAccessKey , and iam:PutUserPolicy .

What happens behind the GUI is:

1. An IAM user name is either inputted (and validated using iam:ListUsers ) or is created (using iam:CreateUser )
2. An inline policy is added to the user's permissions (using iam:PutUserPolicy ) to grant them access to perform ses:SendRawEmail :

"Statement":[{"Effect":"Allow","Action":"ses:SendRawEmail","Resource":"*"}]

3. SMTP credentials are then generated for the above user (using iam:CreateAccessKey )

You essentially need to do the above using the @aws-cdk/aws-iam module, not the @aws-cdk/aws-ses module (as that's for actually using SES).

---

For extra confirmation, here's the AWS console mentioning the above:

Answer 2

The accepted answer does not answer how to generate SMTP credentials in CDK as far as I see.

First you need to create an IAM User and a CfnAccessKey for this user.
Then the SMTP password needs to be generated from the Secret Access Key as documented here:
https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html#smtp-credentials-convert

As far as I see the only way to do this in CDK is by using a CustomResource.
An example of such an implementation can be found here:
https://github.com/binxio/cfn-secret-provider/blob/master/src/cfn_accesskey_provider.py

However, as also mentioned in the README ( https://github.com/isotoma/ses-smtp-credentials-cdk#nota-bene-confidentiality-of-keys ),
the STMP password should not be returned from the CustomResource, but instead stored as a Secret.