belt 0.4.6 → 0.4.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f29c42b3eb7869a90ab1a0a22d56fd6b1304dbd6e22f32503669b3c9b0974890
-  data.tar.gz: f313115ee77ceafb82a4c424c6721f6776f3b869c1b71cc1e458332bc16b53fd
+  metadata.gz: 1f2da2bf0507f4f380a01130c184e6a2bb54103e21274d0aa589ae1dd1d546a7
+  data.tar.gz: 1ad686dae1cf98301b286465beee62b5ae23e3d56541679e93110a9c7fa933ff
 SHA512:
-  metadata.gz: 57150cb2d0934d723b6fafb9eaee652dc933c4522fcae787518d2e03990da13e1c9f229d498b990a86fb1daa90ec3916e4e049e411a418a4534e76f4274a658e
-  data.tar.gz: 8e2d42b8ba9417dacdf725a66cc0e0a0d37e3a7ae59c3085a50f40c7c1e38eb298be49fa0a0ac3d3489e445e3907d85174bc07f45959a385ccbe55a605a5016d
+  metadata.gz: 298cba520960d5ebe54cbc47623aa068ef22ab7888edd3535b77278ef5d71d5d28bd01e7ac02d984d03f4f9baa09b1ff932c87d665a00f218aba12c88be5ac83
+  data.tar.gz: f5fe8ff182396627f1bdd2fd451f664d6bf1848959e7d869a7912709487035df8fd87cdae10ed983aec7181a82a9cd5fca9bb17af6f488bea5bfadcd8cd89c6e

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.4.7
+
+### Bug Fix
+
+- **`apex_dns_sync` now publishes SES DKIM CNAMEs to the root zone.** Apex
+  environments delegate the bare domain to the shared-services root zone, so DNS
+  records written only to the prod-account zone never reach the internet.
+  `ApexDnsSync` already mirrored apex/www/api A aliases and ACM validation CNAMEs
+  into the root zone, but not the 3 SES DKIM CNAMEs — leaving SES domain email at
+  the apex stuck in `PENDING` / `HOST_NOT_FOUND` with every send rejected.
+  `#run` now reads the domain identity's DKIM tokens from SES (under the prod
+  profile) and upserts `<token>._domainkey.<domain>` → `<token>.dkim.amazonses.com`
+  into the root zone via the same cross-account write path. No-ops silently when
+  the domain has no SES identity, so email-less apps are unaffected.
+
 ## 0.4.6
 
 ### Added

data/lib/belt/cli/apex_dns_sync.rb

@@ -62,6 +62,12 @@ module Belt
         # Sync ACM validation first (cert must validate before CloudFront works)
         sync_acm_validation(root_zone_id, targets[:domain])
 
+        # Sync SES DKIM CNAMEs so the email domain identity can verify. Like the
+        # apex A records, these must live in the ROOT zone (the registrar delegates
+        # the apex there) — writing them to the prod account's own zone leaves them
+        # invisible and the SES identity stuck at PENDING/HOST_NOT_FOUND.
+        sync_dkim_cnames(root_zone_id, targets[:domain])
+
         # Sync A alias records
         sync_alias_records(root_zone_id, targets)
 
@@ -303,6 +309,75 @@ module Belt
         end
       end
 
+      # Publish the SES Easy-DKIM CNAMEs for the apex email domain into the root
+      # zone. SES issues three tokens per domain identity; each maps to a CNAME
+      # "<token>._domainkey.<domain>" -> "<token>.dkim.amazonses.com". Publishing
+      # them where the domain is actually delegated (the root zone) is what flips
+      # the identity from PENDING/HOST_NOT_FOUND to verified so sends are accepted.
+      # No-ops quietly when the domain has no SES identity (email not enabled).
+      def sync_dkim_cnames(root_zone_id, domain)
+        return unless domain
+
+        tokens = fetch_dkim_tokens(domain)
+        return if tokens.empty?
+
+        changes = build_dkim_changes(domain, tokens)
+        upsert_dkim_cnames(root_zone_id, changes, tokens.size)
+      end
+
+      # Read the domain identity's DKIM tokens from SES under the PROD profile
+      # (that's the account that owns the identity). Returns [] if there's no
+      # identity or SES call fails, so email-less apps skip silently.
+      def fetch_dkim_tokens(domain)
+        env = aws_env_for(@env_config)
+
+        output, status = Open3.capture2e(
+          env,
+          'aws', 'sesv2', 'get-email-identity',
+          '--email-identity', domain,
+          '--output', 'json'
+        )
+        return [] unless status.success?
+
+        data = parse_json(output) || {}
+        data.dig('DkimAttributes', 'Tokens') || []
+      end
+
+      def build_dkim_changes(domain, tokens)
+        tokens.map do |token|
+          {
+            Action: 'UPSERT',
+            ResourceRecordSet: {
+              Name: "#{token}._domainkey.#{domain}",
+              Type: 'CNAME',
+              TTL: 300,
+              ResourceRecords: [{ Value: "#{token}.dkim.amazonses.com" }]
+            }
+          }
+        end
+      end
+
+      def upsert_dkim_cnames(root_zone_id, changes, count)
+        change_batch = {
+          Comment: 'Belt SES DKIM sync',
+          Changes: changes
+        }
+
+        dns_env = aws_env_for(@dns_config)
+        _, status = Open3.capture2e(
+          dns_env,
+          'aws', 'route53', 'change-resource-record-sets',
+          '--hosted-zone-id', root_zone_id,
+          '--change-batch', JSON.generate(change_batch)
+        )
+
+        if status.success?
+          puts "    ✓ SES DKIM CNAMEs synced (#{count})" unless @quiet
+        else
+          puts '    ⚠ Failed to sync SES DKIM CNAMEs' unless @quiet
+        end
+      end
+
       def alias_change(action, name, target_domain, target_zone_id)
         {
           Action: action,

data/lib/belt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Belt
-  VERSION = '0.4.6'
+  VERSION = '0.4.7'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.4.7
 platform: ruby
 authors:
 - Stowzilla