@deployfoundation/foundation-deploy 0.1.0

package/src/stacks/newsletter-stack.ts

@@ -0,0 +1,572 @@
+import { newsletterManifestFor } from "@deployfoundation/foundation-core/instance";
+import * as cdk from "aws-cdk-lib";
+import * as apigateway from "aws-cdk-lib/aws-apigateway";
+import * as acm from "aws-cdk-lib/aws-certificatemanager";
+import * as cloudwatch from "aws-cdk-lib/aws-cloudwatch";
+import * as cloudwatchActions from "aws-cdk-lib/aws-cloudwatch-actions";
+import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
+import * as iam from "aws-cdk-lib/aws-iam";
+import * as kms from "aws-cdk-lib/aws-kms";
+import * as lambda from "aws-cdk-lib/aws-lambda";
+import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as route53Targets from "aws-cdk-lib/aws-route53-targets";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import * as sns from "aws-cdk-lib/aws-sns";
+import * as snsSubscriptions from "aws-cdk-lib/aws-sns-subscriptions";
+import * as sqs from "aws-cdk-lib/aws-sqs";
+import * as wafv2 from "aws-cdk-lib/aws-wafv2";
+import type { Construct } from "constructs";
+import { lambdaCode } from "../artifacts.ts";
+import { type Instance, namesFor } from "../names.ts";
+
+const ACTIVE_SUBSCRIBER_INDEX = "ScopeStateIndex";
+
+export interface NewsletterStackProps extends cdk.StackProps {
+  instance: Instance;
+  /** Optional email recipient for operational alarms, matching the core API stack. */
+  alarmEmail?: string;
+}
+
+/**
+ * Dedicated public email-marketing boundary. It deliberately does not import
+ * FoundationData, FoundationApi, or an agent role: subscriber PII, token material and SES
+ * permissions are isolated from the conversational runtime.
+ */
+export class NewsletterStack extends cdk.Stack {
+  public readonly subscriberTable: dynamodb.Table;
+  public readonly campaignTable: dynamodb.Table;
+  public readonly campaignQueue: sqs.Queue;
+  public readonly campaignDlq: sqs.Queue;
+  public readonly suppressionDlq: sqs.Queue;
+  public readonly api: apigateway.RestApi;
+  public readonly tokenSigningSecret: secretsmanager.Secret;
+  public readonly campaignOperatorRole: iam.Role;
+
+  constructor(scope: Construct, id: string, props: NewsletterStackProps) {
+    super(scope, id, props);
+    if (!props.instance.newsletter.enabled)
+      throw new Error(
+        `cannot create NewsletterStack: newsletter is disabled for ${props.instance.name}`,
+      );
+    const config = props.instance.newsletter;
+    const names = namesFor(props.instance);
+    const manifest = JSON.stringify(newsletterManifestFor(props.instance));
+    if (Buffer.byteLength(manifest, "utf8") > 3_000)
+      throw new Error("newsletter manifest exceeds the safe Lambda environment limit");
+    const publicPartitionKeys = config.scopes.flatMap(({ businessId, newsletterId }) => [
+      `SCOPE#${businessId}#${newsletterId}`,
+      `QUOTA#${businessId}#${newsletterId}`,
+    ]);
+    const senderAddress = senderAddressFor(config.sender);
+    const identityArn = `arn:${this.partition}:ses:${this.region}:${this.account}:identity/${config.domainIdentity}`;
+    const configurationSetArn = `arn:${this.partition}:ses:${this.region}:${this.account}:configuration-set/${names.newsletterConfigurationSet}`;
+    const zone = route53.HostedZone.fromHostedZoneAttributes(this, "NewsletterHostedZone", {
+      hostedZoneId: config.hostedZoneId,
+      zoneName: config.hostedZoneName,
+    });
+
+    const newsletterKey = new kms.Key(this, "NewsletterKey", {
+      description: `${props.instance.displayName} newsletter PII and queue CMK`,
+      enableKeyRotation: true,
+      alias: names.newsletterKeyAlias,
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.subscriberTable = new dynamodb.Table(this, "SubscriberTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: newsletterKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      timeToLiveAttribute: "ttl",
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+    this.subscriberTable.addGlobalSecondaryIndex({
+      indexName: ACTIVE_SUBSCRIBER_INDEX,
+      partitionKey: { name: "scopeState", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "emailHash", type: dynamodb.AttributeType.STRING },
+      projectionType: dynamodb.ProjectionType.ALL,
+    });
+
+    this.campaignTable = new dynamodb.Table(this, "CampaignTable", {
+      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
+      sortKey: { name: "sk", type: dynamodb.AttributeType.STRING },
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      encryption: dynamodb.TableEncryption.CUSTOMER_MANAGED,
+      encryptionKey: newsletterKey,
+      pointInTimeRecoverySpecification: { pointInTimeRecoveryEnabled: true },
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.tokenSigningSecret = new secretsmanager.Secret(this, "TokenSigningSecret", {
+      secretName: names.newsletterTokenSigningSecret,
+      description: "Newsletter confirmation and unsubscribe token HMAC secret",
+      encryptionKey: newsletterKey,
+      generateSecretString: { passwordLength: 64, excludePunctuation: true },
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
+    this.campaignDlq = new sqs.Queue(this, "CampaignDlq", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-campaign-dlq.fifo`,
+      fifo: true,
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      retentionPeriod: cdk.Duration.days(14),
+    });
+    this.campaignQueue = new sqs.Queue(this, "CampaignQueue", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-campaign.fifo`,
+      fifo: true,
+      contentBasedDeduplication: false,
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      visibilityTimeout: cdk.Duration.minutes(15),
+      retentionPeriod: cdk.Duration.days(14),
+      deadLetterQueue: { queue: this.campaignDlq, maxReceiveCount: 3 },
+    });
+    this.suppressionDlq = new sqs.Queue(this, "SuppressionDlq", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-suppression-dlq`,
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      retentionPeriod: cdk.Duration.days(14),
+    });
+    const suppressionQueue = new sqs.Queue(this, "SuppressionQueue", {
+      queueName: `${props.instance.naming.secretPrefix}-newsletter-suppression`,
+      encryption: sqs.QueueEncryption.KMS,
+      encryptionMasterKey: newsletterKey,
+      enforceSSL: true,
+      visibilityTimeout: cdk.Duration.minutes(5),
+      retentionPeriod: cdk.Duration.days(14),
+      deadLetterQueue: { queue: this.suppressionDlq, maxReceiveCount: 3 },
+    });
+
+    const publicRole = lambdaRole(this, "PublicFunctionRole", "public newsletter opt-in Lambda");
+    publicRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "SubscriberOptInState",
+        actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+        resources: [this.subscriberTable.tableArn],
+        conditions: {
+          "ForAllValues:StringEquals": {
+            "dynamodb:LeadingKeys": publicPartitionKeys,
+          },
+        },
+      }),
+    );
+    this.tokenSigningSecret.grantRead(publicRole);
+    this.campaignQueue.grantSendMessages(publicRole);
+
+    const suppressionRole = lambdaRole(
+      this,
+      "SuppressionFunctionRole",
+      "SES newsletter suppression Lambda",
+    );
+    suppressionRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "SubscriberSuppressionState",
+        actions: ["dynamodb:GetItem", "dynamodb:PutItem"],
+        resources: [this.subscriberTable.tableArn],
+      }),
+    );
+
+    const campaignRole = lambdaRole(
+      this,
+      "CampaignFunctionRole",
+      "newsletter campaign worker Lambda",
+    );
+    campaignRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ReadActiveSubscribers",
+        actions: ["dynamodb:GetItem", "dynamodb:Query"],
+        resources: [
+          this.subscriberTable.tableArn,
+          `${this.subscriberTable.tableArn}/index/${ACTIVE_SUBSCRIBER_INDEX}`,
+        ],
+      }),
+    );
+    campaignRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "CampaignDeliveryState",
+        actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+        resources: [this.campaignTable.tableArn],
+      }),
+    );
+    this.campaignQueue.grantConsumeMessages(campaignRole);
+    this.campaignQueue.grantSendMessages(campaignRole);
+    this.tokenSigningSecret.grantRead(campaignRole);
+    grantSesSend(campaignRole, identityArn, senderAddress);
+
+    const publicFunction = new lambda.Function(this, "PublicFunction", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-public"),
+      role: publicRole,
+      timeout: cdk.Duration.seconds(15),
+      memorySize: 256,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName,
+        NEWSLETTER_TOKEN_SIGNING_SECRET_ID: this.tokenSigningSecret.secretName,
+        NEWSLETTER_CAMPAIGN_QUEUE_URL: this.campaignQueue.queueUrl,
+      },
+    });
+
+    const suppressionFunction = new lambda.Function(this, "SuppressionFunction", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-ses-events"),
+      role: suppressionRole,
+      timeout: cdk.Duration.seconds(30),
+      memorySize: 256,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName,
+      },
+    });
+    suppressionFunction.addEventSource(
+      new lambdaEventSources.SqsEventSource(suppressionQueue, {
+        batchSize: 1,
+        reportBatchItemFailures: false,
+      }),
+    );
+
+    const campaignFunction = new lambda.Function(this, "CampaignFunction", {
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: "index.handler",
+      code: lambdaCode(this, "newsletter-campaign"),
+      role: campaignRole,
+      timeout: cdk.Duration.minutes(15),
+      memorySize: 512,
+      environment: {
+        NEWSLETTER_MANIFEST: manifest,
+        NEWSLETTER_SUBSCRIBER_TABLE_NAME: this.subscriberTable.tableName,
+        NEWSLETTER_CAMPAIGN_TABLE_NAME: this.campaignTable.tableName,
+        NEWSLETTER_CAMPAIGN_QUEUE_URL: this.campaignQueue.queueUrl,
+        NEWSLETTER_TOKEN_SIGNING_SECRET_ID: this.tokenSigningSecret.secretName,
+        NEWSLETTER_CONFIGURATION_SET: names.newsletterConfigurationSet,
+      },
+    });
+    campaignFunction.addEventSource(
+      new lambdaEventSources.SqsEventSource(this.campaignQueue, {
+        batchSize: 1,
+        reportBatchItemFailures: false,
+        maxConcurrency: 2,
+      }),
+    );
+
+    const eventsTopicName = `${props.instance.naming.secretPrefix}-newsletter-ses-events`;
+    const eventsTopic = new sns.Topic(this, "SesEventsTopic", {
+      displayName: `${props.instance.displayName} newsletter SES events`,
+      topicName: eventsTopicName,
+      masterKey: newsletterKey,
+    });
+    newsletterKey.addToResourcePolicy(
+      new iam.PolicyStatement({
+        sid: "AllowSesToEncryptNewsletterEvents",
+        principals: [new iam.ServicePrincipal("ses.amazonaws.com")],
+        actions: ["kms:GenerateDataKey*", "kms:Decrypt"],
+        resources: ["*"],
+        conditions: {
+          StringEquals: {
+            "aws:SourceAccount": this.account,
+            "kms:EncryptionContext:aws:sns:topicArn": `arn:${this.partition}:sns:${this.region}:${this.account}:${eventsTopicName}`,
+          },
+        },
+      }),
+    );
+    eventsTopic.addToResourcePolicy(
+      new iam.PolicyStatement({
+        sid: "AllowOnlyThisSesIdentity",
+        effect: iam.Effect.ALLOW,
+        principals: [new iam.ServicePrincipal("ses.amazonaws.com")],
+        actions: ["sns:Publish"],
+        resources: [eventsTopic.topicArn],
+        conditions: {
+          StringEquals: { "aws:SourceAccount": this.account },
+          ArnLike: { "aws:SourceArn": configurationSetArn },
+        },
+      }),
+    );
+    eventsTopic.addSubscription(
+      new snsSubscriptions.SqsSubscription(suppressionQueue, {
+        rawMessageDelivery: true,
+      }),
+    );
+
+    const identity = new cdk.CfnResource(this, "NewsletterDomainIdentity", {
+      type: "AWS::SES::EmailIdentity",
+      properties: {
+        EmailIdentity: config.domainIdentity,
+        DkimAttributes: { SigningEnabled: true },
+      },
+    });
+    const configurationSet = new cdk.CfnResource(this, "NewsletterConfigurationSet", {
+      type: "AWS::SES::ConfigurationSet",
+      properties: { Name: names.newsletterConfigurationSet },
+    });
+    const eventDestination = new cdk.CfnResource(this, "NewsletterEventDestination", {
+      type: "AWS::SES::ConfigurationSetEventDestination",
+      properties: {
+        ConfigurationSetName: names.newsletterConfigurationSet,
+        EventDestination: {
+          Name: "NewsletterDeliveryAndSuppressionEvents",
+          Enabled: true,
+          MatchingEventTypes: ["DELIVERY", "BOUNCE", "COMPLAINT"],
+          SnsDestination: { TopicARN: eventsTopic.topicArn },
+        },
+      },
+    });
+    eventDestination.addResourceDependency(configurationSet);
+    eventDestination.node.addDependency(eventsTopic);
+    for (const token of ["1", "2", "3"] as const)
+      new route53.CfnRecordSet(this, `NewsletterDkim${token}`, {
+        hostedZoneId: config.hostedZoneId,
+        name: identity.getAtt(`DkimDNSTokenName${token}`).toString(),
+        type: "CNAME",
+        ttl: "1800",
+        resourceRecords: [identity.getAtt(`DkimDNSTokenValue${token}`).toString()],
+      });
+    configurationSet.node.addDependency(identity);
+
+    this.api = new apigateway.RestApi(this, "NewsletterApi", {
+      restApiName: `${props.instance.naming.secretPrefix}-newsletter`,
+      description: `${props.instance.displayName} public confirmed newsletter API`,
+      endpointTypes: [apigateway.EndpointType.REGIONAL],
+      disableExecuteApiEndpoint: true,
+      deployOptions: {
+        stageName: "prod",
+        throttlingRateLimit: 2,
+        throttlingBurstLimit: 4,
+        metricsEnabled: true,
+      },
+      defaultCorsPreflightOptions: {
+        allowOrigins: [...config.allowedOrigins],
+        allowMethods: ["GET", "POST", "OPTIONS"],
+        allowHeaders: ["Content-Type"],
+      },
+      cloudWatchRole: false,
+    });
+    const v1 = this.api.root.addResource("v1");
+    const businesses = v1.addResource("businesses");
+    const business = businesses.addResource("{businessId}");
+    const newsletters = business.addResource("newsletters");
+    const newsletter = newsletters.addResource("{newsletterId}");
+    const integration = new apigateway.LambdaIntegration(publicFunction);
+    newsletter.addResource("subscribe").addMethod("POST", integration);
+    newsletter.addResource("confirm").addMethod("GET", integration);
+    newsletter.addResource("unsubscribe").addMethod("GET", integration);
+    newsletter.getResource("confirm")?.addMethod("POST", integration);
+    newsletter.getResource("unsubscribe")?.addMethod("POST", integration);
+    const webAcl = new wafv2.CfnWebACL(this, "NewsletterWebAcl", {
+      scope: "REGIONAL",
+      defaultAction: { allow: {} },
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: `${props.instance.naming.secretPrefix}-newsletter-api`,
+        sampledRequestsEnabled: false,
+      },
+      rules: [
+        {
+          name: "PerIpSubscribeAbuseLimit",
+          priority: 0,
+          action: { block: {} },
+          statement: {
+            rateBasedStatement: {
+              aggregateKeyType: "IP",
+              limit: 10,
+              scopeDownStatement: {
+                byteMatchStatement: {
+                  fieldToMatch: { uriPath: {} },
+                  positionalConstraint: "ENDS_WITH",
+                  searchString: "/subscribe",
+                  textTransformations: [{ priority: 0, type: "NONE" }],
+                },
+              },
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${props.instance.naming.secretPrefix}-newsletter-subscribe-rate`,
+            sampledRequestsEnabled: false,
+          },
+        },
+      ],
+    });
+    const webAclAssociation = new wafv2.CfnWebACLAssociation(this, "NewsletterWebAclAssociation", {
+      resourceArn: `arn:${this.partition}:apigateway:${this.region}::/restapis/${this.api.restApiId}/stages/${this.api.deploymentStage.stageName}`,
+      webAclArn: webAcl.attrArn,
+    });
+    webAclAssociation.node.addDependency(this.api.deploymentStage);
+
+    const certificate = new acm.Certificate(this, "NewsletterCertificate", {
+      domainName: config.apiDomain,
+      validation: acm.CertificateValidation.fromDns(zone),
+    });
+    const domain = new apigateway.DomainName(this, "NewsletterDomain", {
+      domainName: config.apiDomain,
+      certificate,
+      endpointType: apigateway.EndpointType.REGIONAL,
+      securityPolicy: apigateway.SecurityPolicy.TLS_1_2,
+    });
+    new apigateway.BasePathMapping(this, "NewsletterBasePath", {
+      domainName: domain,
+      restApi: this.api,
+    });
+    new route53.ARecord(this, "NewsletterApiAlias", {
+      zone,
+      recordName: config.apiDomain,
+      target: route53.RecordTarget.fromAlias(new route53Targets.ApiGatewayDomain(domain)),
+    });
+
+    this.campaignOperatorRole = new iam.Role(this, "CampaignOperatorRole", {
+      roleName: names.newsletterCampaignOperatorRole,
+      description: "Human-only newsletter campaign draft, preview and approval role",
+      assumedBy: new iam.AccountPrincipal(this.account),
+      maxSessionDuration: cdk.Duration.hours(1),
+    });
+    this.campaignOperatorRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "CampaignDraftAndApproval",
+        actions: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem"],
+        resources: [this.campaignTable.tableArn],
+      }),
+    );
+    this.campaignQueue.grantSendMessages(this.campaignOperatorRole);
+    this.campaignDlq.grantConsumeMessages(this.campaignOperatorRole);
+    this.campaignOperatorRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "RedriveCampaignFailures",
+        actions: [
+          "sqs:StartMessageMoveTask",
+          "sqs:CancelMessageMoveTask",
+          "sqs:ListMessageMoveTasks",
+        ],
+        resources: [this.campaignDlq.queueArn],
+      }),
+    );
+    this.campaignOperatorRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ReadNewsletterStackOutputs",
+        actions: ["cloudformation:DescribeStacks"],
+        resources: ["*"],
+      }),
+    );
+    this.campaignOperatorRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "RecordApprovalActor",
+        actions: ["sts:GetCallerIdentity"],
+        resources: ["*"],
+      }),
+    );
+
+    const alarmTopic = new sns.Topic(this, "NewsletterAlarmTopic", {
+      displayName: `${props.instance.displayName} newsletter alarms`,
+    });
+    if (props.alarmEmail !== undefined)
+      new sns.Subscription(this, "NewsletterAlarmEmail", {
+        topic: alarmTopic,
+        protocol: sns.SubscriptionProtocol.EMAIL,
+        endpoint: props.alarmEmail,
+      });
+    const alarmAction = new cloudwatchActions.SnsAction(alarmTopic);
+    const alarms = [
+      new cloudwatch.Alarm(this, "CampaignDlqDepthAlarm", {
+        alarmDescription: "Newsletter campaign messages are waiting in the DLQ",
+        metric: this.campaignDlq.metricApproximateNumberOfMessagesVisible({
+          period: cdk.Duration.minutes(5),
+          statistic: "Maximum",
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+      }),
+      new cloudwatch.Alarm(this, "SuppressionDlqDepthAlarm", {
+        alarmDescription: "Newsletter suppression events are waiting in the DLQ",
+        metric: this.suppressionDlq.metricApproximateNumberOfMessagesVisible({
+          period: cdk.Duration.minutes(5),
+          statistic: "Maximum",
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+      }),
+      new cloudwatch.Alarm(this, "CampaignWorkerErrorsAlarm", {
+        alarmDescription: "Newsletter campaign worker is failing",
+        metric: campaignFunction.metricErrors({
+          period: cdk.Duration.minutes(5),
+          statistic: "Sum",
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+      }),
+      new cloudwatch.Alarm(this, "SuppressionWorkerErrorsAlarm", {
+        alarmDescription: "Newsletter suppression worker is failing",
+        metric: suppressionFunction.metricErrors({
+          period: cdk.Duration.minutes(5),
+          statistic: "Sum",
+        }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+      }),
+      new cloudwatch.Alarm(this, "PublicFunctionErrorsAlarm", {
+        alarmDescription: "Newsletter public Lambda is failing",
+        metric: publicFunction.metricErrors({ period: cdk.Duration.minutes(5), statistic: "Sum" }),
+        threshold: 1,
+        evaluationPeriods: 1,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+      }),
+    ];
+    for (const alarm of alarms) alarm.addAlarmAction(alarmAction);
+
+    new cdk.CfnOutput(this, "NewsletterApiUrl", { value: `https://${config.apiDomain}/v1` });
+    new cdk.CfnOutput(this, "SubscriberTableName", { value: this.subscriberTable.tableName });
+    new cdk.CfnOutput(this, "CampaignTableName", { value: this.campaignTable.tableName });
+    new cdk.CfnOutput(this, "CampaignQueueUrl", { value: this.campaignQueue.queueUrl });
+    new cdk.CfnOutput(this, "CampaignDlqArn", { value: this.campaignDlq.queueArn });
+    new cdk.CfnOutput(this, "CampaignDlqUrl", { value: this.campaignDlq.queueUrl });
+    new cdk.CfnOutput(this, "CampaignOperatorRoleArn", {
+      value: this.campaignOperatorRole.roleArn,
+    });
+    new cdk.CfnOutput(this, "NewsletterConfigurationSetName", {
+      value: names.newsletterConfigurationSet,
+    });
+  }
+}
+
+function lambdaRole(scope: Construct, id: string, description: string): iam.Role {
+  return new iam.Role(scope, id, {
+    assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+    description,
+    managedPolicies: [
+      iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+    ],
+  });
+}
+
+function grantSesSend(role: iam.Role, identityArn: string, senderAddress: string): void {
+  role.addToPolicy(
+    new iam.PolicyStatement({
+      sid: "SendFromNewsletterIdentity",
+      actions: ["ses:SendEmail"],
+      resources: [identityArn],
+      conditions: { StringEquals: { "ses:FromAddress": senderAddress } },
+    }),
+  );
+}
+
+function senderAddressFor(sender: string): string {
+  const address = /<([^>]+)>$/.exec(sender)?.[1];
+  if (address === undefined) throw new Error("newsletter sender is not a mailbox");
+  return address;
+}