@infoxchange/make-it-so 2.13.0-internal-testing-randomise-subnet.2 → 2.13.0

package/README.md

@@ -250,14 +250,38 @@ new IxDnsRecord(scope, "IxDnsRecord", {
 
 #### Options:
 
-| Prop         | Type                                       | Description                                                                                                                                                                                                                     |
-| ------------ | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| type         | "A" \| "CNAME" \| "NS" \| "SOA" \| "ALIAS" | DNS record type                                                                                                                                                                                                                 |
-| name         | string                                     | DNS record FQDN                                                                                                                                                                                                                 |
-| value        | string                                     | DNS record value                                                                                                                                                                                                                |
-| ttl          | number                                     | (optional) TTL value for DNS record                                                                                                                                                                                             |
-| hostedZoneId | string                                     | (optional) The ID of the Route53 HostedZone belonging to the dns-hosting account in which to create the DNS record. If not given the correct HostedZone will be inferred from the domain in the "value" prop.                   |
-| aliasZoneId  | string                                     | (only needed if type = "Alias") the Route53 HostedZone that the target of the alias record lives in. Generally this will be the well known ID of a HostedZone for a AWS service itself that is managed by AWS, not an end-user. |
+| Prop         | Type                                                        | Description                                                                                                                                                                                                                     |
+| ------------ | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| type         | "A" \| "CNAME" \| "NS" \| "SOA" \| "ALIAS" \| "TXT" \| "MX" | DNS record type                                                                                                                                                                                                                 |
+| name         | string                                                      | DNS record FQDN                                                                                                                                                                                                                 |
+| value        | string                                                      | DNS record value                                                                                                                                                                                                                |
+| ttl          | number                                                      | (optional) TTL value for DNS record                                                                                                                                                                                             |
+| hostedZoneId | string                                                      | (optional) The ID of the Route53 HostedZone belonging to the dns-hosting account in which to create the DNS record. If not given the correct HostedZone will be inferred from the domain in the "value" prop.                   |
+| aliasZoneId  | string                                                      | (only needed if type = "Alias") the Route53 HostedZone that the target of the alias record lives in. Generally this will be the well known ID of a HostedZone for a AWS service itself that is managed by AWS, not an end-user. |
+| priority     | number                                                      | (only needed if type = "MX") The priority level of the MX record.                                                                                                                                                               |
+
+</details>
+
+<details>
+<summary><strong>IxSESIdentity</strong> - Creates an SES domain identity for a domain managed by IX.</summary>
+
+```typescript
+import { IxSESIdentity } from "@infoxchange/make-it-so/cdk-constructs";
+
+new IxSESIdentity(scope, "IxSESIdentity", {
+  // Email identity domain will be: example.dev.ixapps.org
+  // Custom mail from domain will be: info.example.dev.ixapps.org
+  domain: "example.dev.ixapps.org",
+  mailFromSubdomain: "info", // optional, "mail" will be used otherwise
+});
+```
+
+#### Options:
+
+| Prop              | Type   | Description                                                                                                                                                                           |
+| ----------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| domain            | string | The domain of the identity. An email address can also be provided in which case the domain will be extracted from the email.                                                          |
+| mailFromSubdomain | string | (optional) by default the custom mail from domain will be `mail.${domain}`. This lets you change that. It should be given as just the subdomain part, not the fully qualified domain. |
 
 </details>
 

package/dist/cdk-constructs/IxDnsRecord.d.ts

@@ -7,10 +7,13 @@ type Props = {
     ttl?: number;
     hostedZoneId?: string;
 } & ({
-    type: "A" | "CNAME" | "NS" | "SOA";
+    type: "A" | "CNAME" | "NS" | "SOA" | "TXT";
 } | {
     type: "ALIAS";
     aliasZoneId: string;
+} | {
+    type: "MX";
+    priority: number;
 });
 export declare class IxDnsRecord extends Construct {
     constructor(scope: ConstructScope, id: ConstructId, props: Props);

package/dist/cdk-constructs/IxDnsRecord.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IxDnsRecord.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxDnsRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,KAAK,KAAK,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,CACA;IACE,IAAI,EAAE,GAAG,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC;CACpC,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CACJ,CAAC;AAEF,qBAAa,WAAY,SAAQ,SAAS;gBAC5B,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;IAKhE,OAAO,CAAC,eAAe;CAyBxB"}
+{"version":3,"file":"IxDnsRecord.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxDnsRecord.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,KAAK,KAAK,GAAG;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,CACA;IACE,IAAI,EAAE,GAAG,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;CAC5C,GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB,CACJ,CAAC;AAEF,qBAAa,WAAY,SAAQ,SAAS;gBAC5B,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;IAKhE,OAAO,CAAC,eAAe;CA6CxB"}

package/dist/cdk-constructs/IxDnsRecord.js

@@ -9,14 +9,31 @@ export class IxDnsRecord extends Construct {
     }
     createDnsRecord(scope, id, constructProps) {
         const dnsRecordUpdaterLambdaArn = StringParameter.valueForStringParameter(scope, "/shared-services/route53/lambdaArn");
-        const lambdaProps = remapKeys(constructProps, {
+        const keysMap = {
             name: "RecordFQDN",
             value: "RecordValue",
             ttl: "RecordTTL",
             hostedZoneId: "HostedZoneId",
             type: "RecordType",
             aliasZoneId: "AliasZoneId",
-        });
+        };
+        let lambdaProps;
+        if (constructProps.type === "TXT") {
+            lambdaProps = remapKeys({
+                ...constructProps,
+                value: `"${constructProps.value}"`,
+            }, keysMap);
+        }
+        else if (constructProps.type === "MX") {
+            const { priority, ...rest } = constructProps;
+            lambdaProps = remapKeys({
+                ...rest,
+                value: `${priority} ${rest.value}`,
+            }, keysMap);
+        }
+        else {
+            lambdaProps = remapKeys(constructProps, keysMap);
+        }
         new CustomResource(scope, id + "-CertificateCustomResource", {
             resourceType: "Custom::DNSRecordUpdaterLambda",
             serviceToken: dnsRecordUpdaterLambdaArn,

package/dist/cdk-constructs/IxSESIdentity.d.ts

@@ -0,0 +1,12 @@
+import { Construct } from "constructs";
+type ConstructScope = ConstructorParameters<typeof Construct>[0];
+type ConstructId = ConstructorParameters<typeof Construct>[1];
+type Props = {
+    domain: string;
+    mailFromSubdomain?: string;
+};
+export declare class IxSESIdentity extends Construct {
+    constructor(scope: ConstructScope, id: ConstructId, props: Props);
+}
+export {};
+//# sourceMappingURL=IxSESIdentity.d.ts.map

package/dist/cdk-constructs/IxSESIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IxSESIdentity.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxSESIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAKvC,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;CAuDjE"}

package/dist/cdk-constructs/IxSESIdentity.js

@@ -0,0 +1,45 @@
+import { Construct } from "constructs";
+import { IxDnsRecord } from "./IxDnsRecord.js";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as cdk from "aws-cdk-lib";
+export class IxSESIdentity extends Construct {
+    constructor(scope, id, props) {
+        const domain = props.domain.includes("@")
+            ? props.domain.split("@")[1]
+            : props.domain;
+        const mailFromDomain = `${props.mailFromSubdomain ?? "mail"}.${domain}`;
+        super(scope, id);
+        const identity = new ses.EmailIdentity(scope, `${id}EmailIdentity`, {
+            identity: ses.Identity.domain(domain),
+            mailFromDomain,
+        });
+        // Based on https://github.com/aws/aws-cdk/blob/e2ef65a26c833ecb4a29c22e070c3c5f01c31995/packages/aws-cdk-lib/aws-ses/lib/email-identity.ts#L247
+        for (const i of [1, 2, 3]) {
+            new IxDnsRecord(scope, `${id}DkimDnsToken${i}`, {
+                type: "CNAME",
+                name: identity[`dkimDnsTokenName${i}`],
+                value: identity[`dkimDnsTokenValue${i}`],
+                ttl: 1800,
+            });
+        }
+        // Based on
+        // https://github.com/aws/aws-cdk/blob/e2ef65a26c833ecb4a29c22e070c3c5f01c31995/packages/aws-cdk-lib/aws-ses/lib/email-identity.ts#L512
+        new IxDnsRecord(scope, `${id}MailFromMxRecord`, {
+            type: "MX",
+            name: mailFromDomain,
+            value: `feedback-smtp.${cdk.Stack.of(scope).region}.amazonses.com`,
+            priority: 10,
+        });
+        new IxDnsRecord(scope, `${id}MailFromTxtRecord`, {
+            type: "TXT",
+            name: mailFromDomain,
+            value: "v=spf1 include:amazonses.com ~all",
+        });
+        // Set up DMARC record
+        new IxDnsRecord(scope, `${id}DMARC`, {
+            type: "TXT",
+            name: `_dmarc.${domain}`,
+            value: "v=DMARC1; p=none;",
+        });
+    }
+}

package/dist/cdk-constructs/IxVpcDetails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IxVpcDetails.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxVpcDetails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAO,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGhD,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,qBAAa,YAAa,SAAQ,SAAS;IAClC,GAAG,EAAE,IAAI,CAAC;gBAEL,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW;IAKlD,OAAO,CAAC,MAAM;IAad,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;CAmB7D"}
+{"version":3,"file":"IxVpcDetails.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/IxVpcDetails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAO,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAGhD,KAAK,cAAc,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,WAAW,GAAG,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9D,qBAAa,YAAa,SAAQ,SAAS;IAClC,GAAG,EAAE,IAAI,CAAC;gBAEL,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,WAAW;IAKlD,OAAO,CAAC,MAAM;IAad,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;CAQ7D"}

package/dist/cdk-constructs/IxVpcDetails.js

@@ -21,17 +21,6 @@ export class IxVpcDetails extends Construct {
         });
     }
     static getVpcSubnetIds(scope) {
-        const { workloadGroup, appName } = ixDeployConfig;
-        let suffix = "";
-        if (workloadGroup === "ds") {
-            const possibleSuffixes = ["", "-2"];
-            // Randomly select a suffix to spread workload's IP usage across both sets of subnets. Use the app name as a seed
-            // to ensure consistent selection on redeploys.
-            const hash = appName
-                .split("")
-                .reduce((acc, char) => acc + char.charCodeAt(0), 0);
-            suffix = possibleSuffixes[hash % possibleSuffixes.length];
-        }
-        return [1, 2, 3].map((subnetNum) => StringParameter.valueForStringParameter(scope, `/vpc/subnet/private-${workloadGroup}${suffix}/${subnetNum}/id`));
+        return [1, 2, 3].map((subnetNum) => StringParameter.valueForStringParameter(scope, `/vpc/subnet/private-${ixDeployConfig.workloadGroup}/${subnetNum}/id`));
     }
 }

package/dist/cdk-constructs/SiteOidcAuth/index.js

@@ -165,7 +165,7 @@ export class SiteOidcAuth extends Construct {
             origin: new CloudFrontOrigins.HttpOrigin(CDK.Fn.parseDomainName(authRouteFunctionUrl.url)),
             allowedMethods: CloudFront.AllowedMethods.ALLOW_ALL,
             cachePolicy: new CloudFront.CachePolicy(scope, `${this.id}AllowAllCookiesPolicy`, {
-                cachePolicyName: `${CDK.Stack.of(scope).stackName}-${this.id}-AllowAllCookiesPolicy`,
+                cachePolicyName: `${this.id}-AllowAllCookiesPolicy`,
                 comment: "Cache policy that forwards all cookies",
                 defaultTtl: CDK.Duration.seconds(1),
                 minTtl: CDK.Duration.seconds(1),

package/dist/cdk-constructs/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./IxVpcDetails.js";
 export * from "./IxCertificate.js";
 export * from "./IxDnsRecord.js";
+export * from "./IxSESIdentity.js";
 export * from "./IxNextjsSite.js";
 export * from "./IxStaticSite.js";
 export * from "./IxElasticache.js";

package/dist/cdk-constructs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cdk-constructs/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC"}

package/dist/cdk-constructs/index.js

@@ -1,6 +1,7 @@
 export * from "./IxVpcDetails.js";
 export * from "./IxCertificate.js";
 export * from "./IxDnsRecord.js";
+export * from "./IxSESIdentity.js";
 export * from "./IxNextjsSite.js";
 export * from "./IxStaticSite.js";
 export * from "./IxElasticache.js";

package/dist/lib/utils/objects.d.ts

@@ -1,4 +1,4 @@
 export declare function remapKeys<SourceObject extends object, MapObject extends Record<keyof SourceObject, string>>(object: SourceObject, keyMap: Readonly<MapObject>): {
-    [k in keyof SourceObject]: MapObject[k];
+    [k in keyof SourceObject as k extends keyof MapObject ? MapObject[k] : k]: SourceObject[k];
 };
 //# sourceMappingURL=objects.d.ts.map

package/dist/lib/utils/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/objects.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,CACvB,YAAY,SAAS,MAAM,EAC3B,SAAS,SAAS,MAAM,CAAC,MAAM,YAAY,EAAE,MAAM,CAAC,EAEpD,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B;KAAG,CAAC,IAAI,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;CAAE,CAQ7C"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/objects.ts"],"names":[],"mappings":"AAAA,wBAAgB,SAAS,CACvB,YAAY,SAAS,MAAM,EAC3B,SAAS,SAAS,MAAM,CAAC,MAAM,YAAY,EAAE,MAAM,CAAC,EAEpD,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B;KACA,CAAC,IAAI,MAAM,YAAY,IAAI,CAAC,SAAS,MAAM,SAAS,GACjD,SAAS,CAAC,CAAC,CAAC,GACZ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;CACxB,CAQA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infoxchange/make-it-so",
-  "version": "2.13.0-internal-testing-randomise-subnet.2",
+  "version": "2.13.0",
   "description": "Makes deploying services to IX infra easy",
   "repository": "github:infoxchange/make-it-so",
   "type": "module",

package/src/cdk-constructs/IxDnsRecord.ts

@@ -13,12 +13,16 @@ type Props = {
   hostedZoneId?: string;
 } & (
   | {
-      type: "A" | "CNAME" | "NS" | "SOA";
+      type: "A" | "CNAME" | "NS" | "SOA" | "TXT";
     }
   | {
       type: "ALIAS";
       aliasZoneId: string;
     }
+  | {
+      type: "MX";
+      priority: number;
+    }
 );
 
 export class IxDnsRecord extends Construct {
@@ -36,15 +40,35 @@ export class IxDnsRecord extends Construct {
       scope,
       "/shared-services/route53/lambdaArn",
     );
-
-    const lambdaProps = remapKeys(constructProps, {
+    const keysMap = {
       name: "RecordFQDN",
       value: "RecordValue",
       ttl: "RecordTTL",
       hostedZoneId: "HostedZoneId",
       type: "RecordType",
       aliasZoneId: "AliasZoneId",
-    });
+    };
+    let lambdaProps;
+    if (constructProps.type === "TXT") {
+      lambdaProps = remapKeys(
+        {
+          ...constructProps,
+          value: `"${constructProps.value}"`,
+        },
+        keysMap,
+      );
+    } else if (constructProps.type === "MX") {
+      const { priority, ...rest } = constructProps;
+      lambdaProps = remapKeys(
+        {
+          ...rest,
+          value: `${priority} ${rest.value}`,
+        },
+        keysMap,
+      );
+    } else {
+      lambdaProps = remapKeys(constructProps, keysMap);
+    }
 
     new CustomResource(scope, id + "-CertificateCustomResource", {
       resourceType: "Custom::DNSRecordUpdaterLambda",

package/src/cdk-constructs/IxSESIdentity.ts

@@ -0,0 +1,70 @@
+import { Construct } from "constructs";
+import { IxDnsRecord } from "./IxDnsRecord.js";
+import * as ses from "aws-cdk-lib/aws-ses";
+import * as cdk from "aws-cdk-lib";
+
+type ConstructScope = ConstructorParameters<typeof Construct>[0];
+type ConstructId = ConstructorParameters<typeof Construct>[1];
+
+type Props = {
+  domain: string;
+  mailFromSubdomain?: string;
+};
+
+export class IxSESIdentity extends Construct {
+  constructor(scope: ConstructScope, id: ConstructId, props: Props) {
+    const domain = props.domain.includes("@")
+      ? props.domain.split("@")[1]
+      : props.domain;
+    const mailFromDomain = `${props.mailFromSubdomain ?? "mail"}.${domain}`;
+
+    super(scope, id);
+
+    const identity = new ses.EmailIdentity(scope, `${id}EmailIdentity`, {
+      identity: ses.Identity.domain(domain),
+      mailFromDomain,
+    });
+
+    // Based on https://github.com/aws/aws-cdk/blob/e2ef65a26c833ecb4a29c22e070c3c5f01c31995/packages/aws-cdk-lib/aws-ses/lib/email-identity.ts#L247
+    for (const i of [1, 2, 3]) {
+      new IxDnsRecord(scope, `${id}DkimDnsToken${i}`, {
+        type: "CNAME",
+        name: identity[
+          `dkimDnsTokenName${i}` as
+            | "dkimDnsTokenName1"
+            | "dkimDnsTokenName2"
+            | "dkimDnsTokenName3"
+        ],
+        value:
+          identity[
+            `dkimDnsTokenValue${i}` as
+              | "dkimDnsTokenValue1"
+              | "dkimDnsTokenValue2"
+              | "dkimDnsTokenValue3"
+          ],
+        ttl: 1800,
+      });
+    }
+
+    // Based on
+    // https://github.com/aws/aws-cdk/blob/e2ef65a26c833ecb4a29c22e070c3c5f01c31995/packages/aws-cdk-lib/aws-ses/lib/email-identity.ts#L512
+    new IxDnsRecord(scope, `${id}MailFromMxRecord`, {
+      type: "MX",
+      name: mailFromDomain,
+      value: `feedback-smtp.${cdk.Stack.of(scope).region}.amazonses.com`,
+      priority: 10,
+    });
+    new IxDnsRecord(scope, `${id}MailFromTxtRecord`, {
+      type: "TXT",
+      name: mailFromDomain,
+      value: "v=spf1 include:amazonses.com ~all",
+    });
+
+    // Set up DMARC record
+    new IxDnsRecord(scope, `${id}DMARC`, {
+      type: "TXT",
+      name: `_dmarc.${domain}`,
+      value: "v=DMARC1; p=none;",
+    });
+  }
+}

package/src/cdk-constructs/IxVpcDetails.ts

@@ -28,21 +28,10 @@ export class IxVpcDetails extends Construct {
   }
 
   static getVpcSubnetIds(scope: ConstructScope): Array<string> {
-    const { workloadGroup, appName } = ixDeployConfig;
-    let suffix = "";
-    if (workloadGroup === "ds") {
-      const possibleSuffixes = ["", "-2"];
-      // Randomly select a suffix to spread workload's IP usage across both sets of subnets. Use the app name as a seed
-      // to ensure consistent selection on redeploys.
-      const hash = appName
-        .split("")
-        .reduce((acc, char) => acc + char.charCodeAt(0), 0);
-      suffix = possibleSuffixes[hash % possibleSuffixes.length];
-    }
     return [1, 2, 3].map((subnetNum) =>
       StringParameter.valueForStringParameter(
         scope,
-        `/vpc/subnet/private-${workloadGroup}${suffix}/${subnetNum}/id`,
+        `/vpc/subnet/private-${ixDeployConfig.workloadGroup}/${subnetNum}/id`,
       ),
     );
   }

package/src/cdk-constructs/SiteOidcAuth/index.ts

@@ -274,7 +274,7 @@ export class SiteOidcAuth extends Construct {
         scope,
         `${this.id}AllowAllCookiesPolicy`,
         {
-          cachePolicyName: `${CDK.Stack.of(scope).stackName}-${this.id}-AllowAllCookiesPolicy`,
+          cachePolicyName: `${this.id}-AllowAllCookiesPolicy`,
           comment: "Cache policy that forwards all cookies",
           defaultTtl: CDK.Duration.seconds(1),
           minTtl: CDK.Duration.seconds(1),

package/src/cdk-constructs/index.ts

@@ -1,6 +1,7 @@
 export * from "./IxVpcDetails.js";
 export * from "./IxCertificate.js";
 export * from "./IxDnsRecord.js";
+export * from "./IxSESIdentity.js";
 export * from "./IxNextjsSite.js";
 export * from "./IxStaticSite.js";
 export * from "./IxElasticache.js";

package/src/lib/utils/objects.ts

@@ -4,7 +4,11 @@ export function remapKeys<
 >(
   object: SourceObject,
   keyMap: Readonly<MapObject>,
-): { [k in keyof SourceObject]: MapObject[k] } {
+): {
+  [k in keyof SourceObject as k extends keyof MapObject
+    ? MapObject[k]
+    : k]: SourceObject[k];
+} {
   return Object.fromEntries(
     Object.entries(object).map(([key, value]) => {
       // @ts-expect-error the typing for map() reduces keys to general string