@everydaydevopsio/hail 0.0.0-stage → 0.1.2

package/terraform/examples/cloudflare/main.tf

@@ -0,0 +1,95 @@
+terraform {
+  required_version = ">= 1.7, < 2.0"
+  required_providers {
+    aws        = { source = "hashicorp/aws", version = ">= 5.50, < 7.0" }
+    cloudflare = { source = "cloudflare/cloudflare", version = "~> 5.0" }
+  }
+}
+provider "aws" { region = var.region }
+# Reads CLOUDFLARE_API_TOKEN from the environment. Do not put it in tfvars.
+provider "cloudflare" {}
+variable "name" { type = string }
+variable "domain" { type = string }
+variable "zone_name" { type = string }
+variable "zone_id" { type = string }
+variable "region" { type = string }
+variable "existing_rule_set_name" {
+  type    = string
+  default = null
+}
+variable "manage_rule_set_activation" {
+  type    = bool
+  default = false
+}
+variable "retention_days" {
+  type    = number
+  default = 3
+}
+variable "reader_principal_arns" {
+  type    = list(string)
+  default = []
+}
+variable "external_indexer_role_arn" {
+  type    = string
+  default = null
+}
+variable "external_reader_role_arn" {
+  type    = string
+  default = null
+}
+variable "permissions_boundary_arn" {
+  type    = string
+  default = null
+}
+variable "tags" {
+  type    = map(string)
+  default = {}
+}
+data "cloudflare_zone" "selected" { zone_id = var.zone_id }
+resource "terraform_data" "guard" {
+  input = var.domain
+  lifecycle {
+    precondition {
+      condition     = data.cloudflare_zone.selected.name == var.zone_name && var.domain != var.zone_name && endswith(var.domain, ".${var.zone_name}")
+      error_message = "Use a dedicated subdomain of the selected existing zone; never the zone apex."
+    }
+  }
+}
+module "receiver" {
+  source                     = "../../modules/receiver"
+  name                       = var.name
+  domain                     = var.domain
+  region                     = var.region
+  existing_rule_set_name     = var.existing_rule_set_name
+  manage_rule_set_activation = var.manage_rule_set_activation
+  retention_days             = var.retention_days
+  reader_principal_arns      = var.reader_principal_arns
+  external_indexer_role_arn  = var.external_indexer_role_arn
+  external_reader_role_arn   = var.external_reader_role_arn
+  permissions_boundary_arn   = var.permissions_boundary_arn
+  tags                       = var.tags
+  depends_on                 = [terraform_data.guard]
+}
+resource "cloudflare_dns_record" "mx" {
+  zone_id  = var.zone_id
+  name     = var.domain
+  type     = "MX"
+  content  = module.receiver.mx_target
+  priority = 10
+  ttl      = 300
+}
+resource "cloudflare_dns_record" "verification" {
+  zone_id = var.zone_id
+  name    = "_amazonses.${var.domain}"
+  type    = "TXT"
+  content = module.receiver.verification_token
+  ttl     = 300
+}
+resource "aws_ses_domain_identity_verification" "receiver" {
+  domain     = var.domain
+  depends_on = [cloudflare_dns_record.mx, cloudflare_dns_record.verification]
+}
+output "hail_config" { value = module.receiver.hail_config }
+output "dns_records" { value = module.receiver.dns_records }
+output "reader_policy_arn" { value = module.receiver.reader_policy_arn }
+output "dlq_url" { value = module.receiver.dlq_url }

package/terraform/examples/manual/.terraform.lock.hcl

@@ -0,0 +1,47 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/archive" {
+  version     = "2.8.1"
+  constraints = ">= 2.4.0, < 3.0.0"
+  hashes = [
+    "h1:KfIRyazppfpvRKIW5URe4sIVRPPdcbtt4ddkYd1Bw3Y=",
+    "zh:03de290604114a89fcd45c2e5bc7787d5a1ebfc5f964fb5989306bea7a4c79ec",
+    "zh:0a7d69dc9fbbc48960bc2f04588c8fb1bd92c78a8f306566b7fb17fc4a4f2058",
+    "zh:4df1f3981379c35f1757da957470f7f7724496b57219da3485177cf1647bdf59",
+    "zh:50f0e72ba53bfe6e11b03b7fc899e1f72536354381d302a743a274ae2a3f45f4",
+    "zh:5c4e15a04c98e2a8cafb1cd9632b48ad318051e8462d105b1153006277985c35",
+    "zh:66069e604bcf5c4af0278e15997d9e6bd755c54fb3801d78885838b889729c5f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:979765db3f42601870ab377104ba70befb029547b278337ec4ada980e3582de6",
+    "zh:b165254da774f49945a73fbccc3ef1b63d70ea00a98fa9e14716665ba80ecaad",
+    "zh:c0bb2697b525da9fec4511f569ed2bd2b42f25d5c1f9fa00f8f3645b50cfc2e9",
+    "zh:c48f6695d12df0d0fa5231f7c1b8d518a4feae91a733fdd35a5804af3a303831",
+    "zh:d589954c93f075180c9f4e2ce91780d5edcb56dfd0d3cda8ba08e13c10b52249",
+    "zh:f5792ed06da65d0daf7ca3711f5399ff78c7cb4400afe53fbce9a926fbde4477",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.66.0"
+  constraints = ">= 5.50.0, < 7.0.0"
+  hashes = [
+    "h1:hBEaeBm9nm7A/u1nnD0nfolTPP55/BoKRFWk8zG8/fk=",
+    "zh:156fe7164a3d26ef6b35734c43e99fb198df90575ed897d1182b8e930b8cd523",
+    "zh:1af52b22b35be00f8d16e3ebebff9fa699ec4db2ef69e6032ba5c536f80c03d9",
+    "zh:2545a8478bd551fdc9694f6cc1a1ad24617f6736f8bde0ad6cae90987c65380f",
+    "zh:4070db1ee369ccb41cb610bfd887386bc0a9b9ecad60aeb4dbce58443d2519dd",
+    "zh:53da7d3c1840ef875c7d34e967732502a64fe677af0e78824773d4c15a8fe740",
+    "zh:576a93a28bf611a4de2a2e6ced697a41d5126b8fd31d30782b16797e410a9706",
+    "zh:58fed5fa9a033355b9d4f3092c817b70d934100e0d8678d6e4c93f3c9493d4e4",
+    "zh:6a9ca2f24e2ee9156dd785d159a850b35d190e9cf7eca21cb9582970c2db80cd",
+    "zh:729edd30f99cc16009deba5c013265b0c81eda261a3d0821cbd011d3287fd230",
+    "zh:7ae460049b75bd4aefee465ef7c53a01ac2df46d4d3e3ac00824afa8b5cb83fb",
+    "zh:9051fa85c8034ade8a57a5c6f232fd33da28f3800bb5aa40bc8625dbc5e27632",
+    "zh:906547e4319805e7acf7fbdf2bac28a4b1a7370790a2a430c7adb1b29bb934eb",
+    "zh:998f27410a66158a35ee5ed142c27e5b21fe8601941da55da2157f8042d6dcca",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9c1804eff1dda0446dc2d215231015bb65a2fc6c3b7ba24584fe45f1ddd3fa9f",
+    "zh:b03ff5efdee310502aaaeb460144dc059bce72a0d8217e6b989099ef8aef9283",
+  ]
+}

package/terraform/examples/manual/main.tf

@@ -0,0 +1,71 @@
+terraform {
+  required_version = ">= 1.7, < 2.0"
+  required_providers { aws = { source = "hashicorp/aws", version = ">= 5.50, < 7.0" } }
+}
+provider "aws" { region = var.region }
+variable "name" { type = string }
+variable "domain" { type = string }
+variable "zone_name" { type = string }
+variable "region" { type = string }
+variable "existing_rule_set_name" {
+  type    = string
+  default = null
+}
+variable "manage_rule_set_activation" {
+  type    = bool
+  default = false
+}
+variable "retention_days" {
+  type    = number
+  default = 3
+}
+variable "reader_principal_arns" {
+  type    = list(string)
+  default = []
+}
+variable "external_indexer_role_arn" {
+  type    = string
+  default = null
+}
+variable "external_reader_role_arn" {
+  type    = string
+  default = null
+}
+variable "permissions_boundary_arn" {
+  type    = string
+  default = null
+}
+variable "tags" {
+  type    = map(string)
+  default = {}
+}
+resource "terraform_data" "guard" {
+  input = var.domain
+  lifecycle {
+    precondition {
+      condition     = var.domain != var.zone_name && endswith(var.domain, ".${var.zone_name}")
+      error_message = "Use a dedicated test subdomain; never change the company email domain."
+    }
+  }
+}
+module "receiver" {
+  source                     = "../../modules/receiver"
+  name                       = var.name
+  domain                     = var.domain
+  region                     = var.region
+  existing_rule_set_name     = var.existing_rule_set_name
+  manage_rule_set_activation = var.manage_rule_set_activation
+  retention_days             = var.retention_days
+  reader_principal_arns      = var.reader_principal_arns
+  external_indexer_role_arn  = var.external_indexer_role_arn
+  external_reader_role_arn   = var.external_reader_role_arn
+  permissions_boundary_arn   = var.permissions_boundary_arn
+  tags                       = var.tags
+  depends_on                 = [terraform_data.guard]
+}
+# Manual mode deliberately does not wait for DNS during apply.
+# Publish dns_records, then run `hail doctor` to verify readiness.
+output "hail_config" { value = module.receiver.hail_config }
+output "dns_records" { value = module.receiver.dns_records }
+output "reader_policy_arn" { value = module.receiver.reader_policy_arn }
+output "dlq_url" { value = module.receiver.dlq_url }

package/terraform/examples/route53/.terraform.lock.hcl

@@ -0,0 +1,47 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/archive" {
+  version     = "2.8.1"
+  constraints = ">= 2.4.0, < 3.0.0"
+  hashes = [
+    "h1:KfIRyazppfpvRKIW5URe4sIVRPPdcbtt4ddkYd1Bw3Y=",
+    "zh:03de290604114a89fcd45c2e5bc7787d5a1ebfc5f964fb5989306bea7a4c79ec",
+    "zh:0a7d69dc9fbbc48960bc2f04588c8fb1bd92c78a8f306566b7fb17fc4a4f2058",
+    "zh:4df1f3981379c35f1757da957470f7f7724496b57219da3485177cf1647bdf59",
+    "zh:50f0e72ba53bfe6e11b03b7fc899e1f72536354381d302a743a274ae2a3f45f4",
+    "zh:5c4e15a04c98e2a8cafb1cd9632b48ad318051e8462d105b1153006277985c35",
+    "zh:66069e604bcf5c4af0278e15997d9e6bd755c54fb3801d78885838b889729c5f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:979765db3f42601870ab377104ba70befb029547b278337ec4ada980e3582de6",
+    "zh:b165254da774f49945a73fbccc3ef1b63d70ea00a98fa9e14716665ba80ecaad",
+    "zh:c0bb2697b525da9fec4511f569ed2bd2b42f25d5c1f9fa00f8f3645b50cfc2e9",
+    "zh:c48f6695d12df0d0fa5231f7c1b8d518a4feae91a733fdd35a5804af3a303831",
+    "zh:d589954c93f075180c9f4e2ce91780d5edcb56dfd0d3cda8ba08e13c10b52249",
+    "zh:f5792ed06da65d0daf7ca3711f5399ff78c7cb4400afe53fbce9a926fbde4477",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.66.0"
+  constraints = ">= 5.50.0, < 7.0.0"
+  hashes = [
+    "h1:hBEaeBm9nm7A/u1nnD0nfolTPP55/BoKRFWk8zG8/fk=",
+    "zh:156fe7164a3d26ef6b35734c43e99fb198df90575ed897d1182b8e930b8cd523",
+    "zh:1af52b22b35be00f8d16e3ebebff9fa699ec4db2ef69e6032ba5c536f80c03d9",
+    "zh:2545a8478bd551fdc9694f6cc1a1ad24617f6736f8bde0ad6cae90987c65380f",
+    "zh:4070db1ee369ccb41cb610bfd887386bc0a9b9ecad60aeb4dbce58443d2519dd",
+    "zh:53da7d3c1840ef875c7d34e967732502a64fe677af0e78824773d4c15a8fe740",
+    "zh:576a93a28bf611a4de2a2e6ced697a41d5126b8fd31d30782b16797e410a9706",
+    "zh:58fed5fa9a033355b9d4f3092c817b70d934100e0d8678d6e4c93f3c9493d4e4",
+    "zh:6a9ca2f24e2ee9156dd785d159a850b35d190e9cf7eca21cb9582970c2db80cd",
+    "zh:729edd30f99cc16009deba5c013265b0c81eda261a3d0821cbd011d3287fd230",
+    "zh:7ae460049b75bd4aefee465ef7c53a01ac2df46d4d3e3ac00824afa8b5cb83fb",
+    "zh:9051fa85c8034ade8a57a5c6f232fd33da28f3800bb5aa40bc8625dbc5e27632",
+    "zh:906547e4319805e7acf7fbdf2bac28a4b1a7370790a2a430c7adb1b29bb934eb",
+    "zh:998f27410a66158a35ee5ed142c27e5b21fe8601941da55da2157f8042d6dcca",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9c1804eff1dda0446dc2d215231015bb65a2fc6c3b7ba24584fe45f1ddd3fa9f",
+    "zh:b03ff5efdee310502aaaeb460144dc059bce72a0d8217e6b989099ef8aef9283",
+  ]
+}

package/terraform/examples/route53/main.tf

@@ -0,0 +1,94 @@
+terraform {
+  required_version = ">= 1.7, < 2.0"
+  required_providers { aws = { source = "hashicorp/aws", version = ">= 5.50, < 7.0" } }
+}
+provider "aws" { region = var.region }
+variable "name" { type = string }
+variable "domain" { type = string }
+variable "zone_name" { type = string }
+variable "zone_id" { type = string }
+variable "region" { type = string }
+variable "existing_rule_set_name" {
+  type    = string
+  default = null
+}
+variable "manage_rule_set_activation" {
+  type    = bool
+  default = false
+}
+variable "retention_days" {
+  type    = number
+  default = 3
+}
+variable "reader_principal_arns" {
+  type    = list(string)
+  default = []
+}
+variable "external_indexer_role_arn" {
+  type    = string
+  default = null
+}
+variable "external_reader_role_arn" {
+  type    = string
+  default = null
+}
+variable "permissions_boundary_arn" {
+  type    = string
+  default = null
+}
+variable "tags" {
+  type    = map(string)
+  default = {}
+}
+data "aws_route53_zone" "selected" {
+  zone_id      = var.zone_id
+  private_zone = false
+}
+resource "terraform_data" "guard" {
+  input = var.domain
+  lifecycle {
+    precondition {
+      condition     = !data.aws_route53_zone.selected.private_zone && trimsuffix(data.aws_route53_zone.selected.name, ".") == var.zone_name && var.domain != var.zone_name && endswith(var.domain, ".${var.zone_name}")
+      error_message = "Use a dedicated subdomain of the selected PUBLIC hosted zone; never the zone apex."
+    }
+  }
+}
+module "receiver" {
+  source                     = "../../modules/receiver"
+  name                       = var.name
+  domain                     = var.domain
+  region                     = var.region
+  existing_rule_set_name     = var.existing_rule_set_name
+  manage_rule_set_activation = var.manage_rule_set_activation
+  retention_days             = var.retention_days
+  reader_principal_arns      = var.reader_principal_arns
+  external_indexer_role_arn  = var.external_indexer_role_arn
+  external_reader_role_arn   = var.external_reader_role_arn
+  permissions_boundary_arn   = var.permissions_boundary_arn
+  tags                       = var.tags
+  depends_on                 = [terraform_data.guard]
+}
+resource "aws_route53_record" "mx" {
+  zone_id         = var.zone_id
+  name            = var.domain
+  type            = "MX"
+  ttl             = 300
+  records         = ["10 ${module.receiver.mx_target}"]
+  allow_overwrite = false
+}
+resource "aws_route53_record" "verification" {
+  zone_id         = var.zone_id
+  name            = "_amazonses.${var.domain}"
+  type            = "TXT"
+  ttl             = 300
+  records         = [module.receiver.verification_token]
+  allow_overwrite = false
+}
+resource "aws_ses_domain_identity_verification" "receiver" {
+  domain     = var.domain
+  depends_on = [aws_route53_record.mx, aws_route53_record.verification]
+}
+output "hail_config" { value = module.receiver.hail_config }
+output "dns_records" { value = module.receiver.dns_records }
+output "reader_policy_arn" { value = module.receiver.reader_policy_arn }
+output "dlq_url" { value = module.receiver.dlq_url }

package/terraform/modules/receiver/.terraform.lock.hcl

@@ -0,0 +1,47 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/archive" {
+  version     = "2.8.1"
+  constraints = ">= 2.4.0, < 3.0.0"
+  hashes = [
+    "h1:KfIRyazppfpvRKIW5URe4sIVRPPdcbtt4ddkYd1Bw3Y=",
+    "zh:03de290604114a89fcd45c2e5bc7787d5a1ebfc5f964fb5989306bea7a4c79ec",
+    "zh:0a7d69dc9fbbc48960bc2f04588c8fb1bd92c78a8f306566b7fb17fc4a4f2058",
+    "zh:4df1f3981379c35f1757da957470f7f7724496b57219da3485177cf1647bdf59",
+    "zh:50f0e72ba53bfe6e11b03b7fc899e1f72536354381d302a743a274ae2a3f45f4",
+    "zh:5c4e15a04c98e2a8cafb1cd9632b48ad318051e8462d105b1153006277985c35",
+    "zh:66069e604bcf5c4af0278e15997d9e6bd755c54fb3801d78885838b889729c5f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:979765db3f42601870ab377104ba70befb029547b278337ec4ada980e3582de6",
+    "zh:b165254da774f49945a73fbccc3ef1b63d70ea00a98fa9e14716665ba80ecaad",
+    "zh:c0bb2697b525da9fec4511f569ed2bd2b42f25d5c1f9fa00f8f3645b50cfc2e9",
+    "zh:c48f6695d12df0d0fa5231f7c1b8d518a4feae91a733fdd35a5804af3a303831",
+    "zh:d589954c93f075180c9f4e2ce91780d5edcb56dfd0d3cda8ba08e13c10b52249",
+    "zh:f5792ed06da65d0daf7ca3711f5399ff78c7cb4400afe53fbce9a926fbde4477",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.66.0"
+  constraints = ">= 5.50.0, < 7.0.0"
+  hashes = [
+    "h1:hBEaeBm9nm7A/u1nnD0nfolTPP55/BoKRFWk8zG8/fk=",
+    "zh:156fe7164a3d26ef6b35734c43e99fb198df90575ed897d1182b8e930b8cd523",
+    "zh:1af52b22b35be00f8d16e3ebebff9fa699ec4db2ef69e6032ba5c536f80c03d9",
+    "zh:2545a8478bd551fdc9694f6cc1a1ad24617f6736f8bde0ad6cae90987c65380f",
+    "zh:4070db1ee369ccb41cb610bfd887386bc0a9b9ecad60aeb4dbce58443d2519dd",
+    "zh:53da7d3c1840ef875c7d34e967732502a64fe677af0e78824773d4c15a8fe740",
+    "zh:576a93a28bf611a4de2a2e6ced697a41d5126b8fd31d30782b16797e410a9706",
+    "zh:58fed5fa9a033355b9d4f3092c817b70d934100e0d8678d6e4c93f3c9493d4e4",
+    "zh:6a9ca2f24e2ee9156dd785d159a850b35d190e9cf7eca21cb9582970c2db80cd",
+    "zh:729edd30f99cc16009deba5c013265b0c81eda261a3d0821cbd011d3287fd230",
+    "zh:7ae460049b75bd4aefee465ef7c53a01ac2df46d4d3e3ac00824afa8b5cb83fb",
+    "zh:9051fa85c8034ade8a57a5c6f232fd33da28f3800bb5aa40bc8625dbc5e27632",
+    "zh:906547e4319805e7acf7fbdf2bac28a4b1a7370790a2a430c7adb1b29bb934eb",
+    "zh:998f27410a66158a35ee5ed142c27e5b21fe8601941da55da2157f8042d6dcca",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9c1804eff1dda0446dc2d215231015bb65a2fc6c3b7ba24584fe45f1ddd3fa9f",
+    "zh:b03ff5efdee310502aaaeb460144dc059bce72a0d8217e6b989099ef8aef9283",
+  ]
+}

package/terraform/modules/receiver/lambda/handler.py

@@ -0,0 +1,83 @@
+"""Retryable SES S3-action -> SNS (raw) -> SQS mailbox indexer.
+
+Derived from markcallen/ses-receiving-terraform. Keep raw MIME immutable;
+write deterministic per-envelope-recipient metadata only after S3 confirms it.
+"""
+import json
+import logging
+import os
+import re
+from datetime import datetime
+
+import boto3
+
+s3 = boto3.client("s3")
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.INFO)
+
+
+def index_notification(payload):
+    bucket = os.environ["BUCKET"]
+    domain = os.environ["DOMAIN"].lower()
+    if payload.get("Type") == "Notification":
+        payload = json.loads(payload["Message"])
+    if payload.get("notificationType") != "Received":
+        raise ValueError("Expected an SES receiving notification")
+    mail, receipt = payload["mail"], payload["receipt"]
+    message_id = mail["messageId"]
+    if not isinstance(message_id, str) or not re.fullmatch(r"[a-zA-Z0-9_-]{1,200}", message_id):
+        raise ValueError("Invalid SES message ID")
+    raw_key = f"incoming/{message_id}"
+    action = receipt["action"]
+    if action.get("type") != "S3" or action.get("bucketName") != bucket or action.get("objectKey") not in (message_id, raw_key):
+        raise ValueError("Unexpected SES storage action")
+    received_at = mail["timestamp"]
+    timestamp = datetime.fromisoformat(received_at.replace("Z", "+00:00"))
+    if timestamp.tzinfo is None:
+        raise ValueError("Receipt timestamp must include a timezone")
+    # A failed read raises, leaving the SQS record available for retry.
+    head = s3.head_object(Bucket=bucket, Key=raw_key)
+    if head["ContentLength"] > 16 * 1024 * 1024:
+        raise ValueError("Message exceeds Hail's 16 MiB limit")
+    delivery = {
+        name: receipt[name]["status"]
+        for name in ("spfVerdict", "dkimVerdict", "dmarcVerdict", "spamVerdict", "virusVerdict")
+        if isinstance(receipt.get(name), dict) and isinstance(receipt[name].get("status"), str)
+    }
+    recipients = receipt["recipients"]
+    if not isinstance(recipients, list):
+        raise ValueError("Expected envelope recipients")
+    for recipient in sorted(set(value.lower() for value in recipients)):
+        local, separator, recipient_domain = recipient.partition("@")
+        if separator != "@" or recipient_domain != domain:
+            continue
+        if not re.fullmatch(r"[a-z0-9][a-z0-9._+-]{0,63}", local):
+            continue
+        metadata = {
+            "schemaVersion": 1,
+            "messageId": message_id,
+            "recipient": recipient,
+            "receivedAt": received_at,
+            "rawKey": raw_key,
+            "delivery": delivery,
+        }
+        # Same key and body on retries. Never delete raw mail or emit S3 events.
+        s3.put_object(
+            Bucket=bucket,
+            Key=f"index/{recipient}/{message_id}.json",
+            Body=json.dumps(metadata, sort_keys=True).encode("utf-8"),
+            ContentType="application/json",
+        )
+
+
+def handler(event, context):
+    failures = []
+    for record in event["Records"]:
+        identifier = record["messageId"]
+        try:
+            index_notification(json.loads(record["body"]))
+        except Exception as error:
+            # Do not log message bodies, recipients, subjects, or token-bearing URLs.
+            logger.error("Mail indexing failed (%s)", type(error).__name__)
+            failures.append({"itemIdentifier": identifier})
+    return {"batchItemFailures": failures}