@deployfoundation/foundation-deploy 0.2.9 → 0.2.10

package/dist/bin/app.js

@@ -7,7 +7,7 @@ import {
   FoundationNetwork,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-4z1tsy0m.js";
+} from "../chunk-sxvts8bf.js";
 import {
   adminsFor,
   instanceNames,

package/dist/{chunk-4z1tsy0m.js → chunk-sxvts8bf.js}

@@ -2304,7 +2304,7 @@ class NewsletterStack extends cdk6.Stack {
     this.campaignQueue.grantConsumeMessages(campaignRole);
     this.campaignQueue.grantSendMessages(campaignRole);
     this.tokenSigningSecret.grantRead(campaignRole);
-    grantSesSend(campaignRole, identityArn, senderAddress);
+    grantSesSend(campaignRole, identityArn, configurationSetArn, senderAddress);
     const publicFunction = new lambda2.Function(this, "PublicFunction", {
       runtime: lambda2.Runtime.NODEJS_22_X,
       handler: "index.handler",
@@ -2631,13 +2631,18 @@ function lambdaRole(scope, id, description) {
     ]
   });
 }
-function grantSesSend(role, identityArn, senderAddress) {
+function grantSesSend(role, identityArn, configurationSetArn, senderAddress) {
   role.addToPolicy(new iam7.PolicyStatement({
     sid: "SendFromNewsletterIdentity",
     actions: ["ses:SendEmail"],
     resources: [identityArn],
     conditions: { StringEquals: { "ses:FromAddress": senderAddress } }
   }));
+  role.addToPolicy(new iam7.PolicyStatement({
+    sid: "SendThroughNewsletterConfigurationSet",
+    actions: ["ses:SendEmail"],
+    resources: [configurationSetArn]
+  }));
 }
 function senderAddressFor(sender) {
   const address = /<([^>]+)>$/.exec(sender)?.[1];

package/dist/src/index.js

@@ -9,7 +9,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-4z1tsy0m.js";
+} from "../chunk-sxvts8bf.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/newsletter-stack.ts

@@ -198,7 +198,7 @@ export class NewsletterStack extends cdk.Stack {
     this.campaignQueue.grantConsumeMessages(campaignRole);
     this.campaignQueue.grantSendMessages(campaignRole);
     this.tokenSigningSecret.grantRead(campaignRole);
-    grantSesSend(campaignRole, identityArn, senderAddress);
+    grantSesSend(campaignRole, identityArn, configurationSetArn, senderAddress);
 
     const publicFunction = new lambda.Function(this, "PublicFunction", {
       runtime: lambda.Runtime.NODEJS_22_X,
@@ -554,7 +554,12 @@ function lambdaRole(scope: Construct, id: string, description: string): iam.Role
   });
 }
 
-function grantSesSend(role: iam.Role, identityArn: string, senderAddress: string): void {
+function grantSesSend(
+  role: iam.Role,
+  identityArn: string,
+  configurationSetArn: string,
+  senderAddress: string,
+): void {
   role.addToPolicy(
     new iam.PolicyStatement({
       sid: "SendFromNewsletterIdentity",
@@ -563,6 +568,18 @@ function grantSesSend(role: iam.Role, identityArn: string, senderAddress: string
       conditions: { StringEquals: { "ses:FromAddress": senderAddress } },
     }),
   );
+  // SES v2 authorizes a send against EVERY resource it names, and each send
+  // names the configuration set (that is how delivery, bounce and complaint
+  // events reach the suppression queue). Without this, every confirmation and
+  // campaign send was an AccessDeniedException. The sender stays pinned by the
+  // identity statement above.
+  role.addToPolicy(
+    new iam.PolicyStatement({
+      sid: "SendThroughNewsletterConfigurationSet",
+      actions: ["ses:SendEmail"],
+      resources: [configurationSetArn],
+    }),
+  );
 }
 
 function senderAddressFor(sender: string): string {