@maestro-js/aws-cdk-recipes 1.0.0-alpha.28 → 1.0.0-alpha.29

package/dist/index.d.ts

@@ -4846,7 +4846,21 @@ declare class Email extends Construct {
     private _sender;
     get sender(): string;
     get configSetName(): string;
+    /**
+     * The ARN of the configuration set. `aws-cdk-lib`'s {@link ses.ConfigurationSet} exposes only
+     * `configurationSetName`, so we build the ARN ourselves — consumers need it to grant access to
+     * the config-set resource (see {@link grantSendEmail}).
+     */
+    get configurationSetArn(): string;
     constructor(scope: Construct, id: string, props: Email.Props);
+    /**
+     * Grant a principal permission to send email through this identity **and** its configuration set.
+     *
+     * The recipe wires the app to send through the configuration set it creates, so authorizing only
+     * the identity ({@link ses.EmailIdentity.grantSendEmail}) is a silent under-grant: SES rejects the
+     * send when the caller lacks access to the config-set resource. This grants both by construction.
+     */
+    grantSendEmail(grantee: iam.IGrantable): iam.Grant;
 }
 /**
  * Configuration types for {@link Email}.

package/dist/index.js

@@ -4186,8 +4186,10 @@ function resolveParameterGroupFamily(engine, version) {
 }
 
 // src/email.ts
+import { Stack as Stack7 } from "aws-cdk-lib";
 import { Construct as Construct31 } from "constructs";
 import * as ses from "aws-cdk-lib/aws-ses";
+import * as iam18 from "aws-cdk-lib/aws-iam";
 import * as route532 from "aws-cdk-lib/aws-route53";
 var Email = class extends Construct31 {
   identity;
@@ -4200,6 +4202,18 @@ var Email = class extends Construct31 {
   get configSetName() {
     return this.configurationSet.configurationSetName;
   }
+  /**
+   * The ARN of the configuration set. `aws-cdk-lib`'s {@link ses.ConfigurationSet} exposes only
+   * `configurationSetName`, so we build the ARN ourselves — consumers need it to grant access to
+   * the config-set resource (see {@link grantSendEmail}).
+   */
+  get configurationSetArn() {
+    return Stack7.of(this).formatArn({
+      service: "ses",
+      resource: "configuration-set",
+      resourceName: this.configurationSet.configurationSetName
+    });
+  }
   constructor(scope, id, props) {
     super(scope, id);
     this._sender = props.sender;
@@ -4244,6 +4258,20 @@ var Email = class extends Construct31 {
       }
     }
   }
+  /**
+   * Grant a principal permission to send email through this identity **and** its configuration set.
+   *
+   * The recipe wires the app to send through the configuration set it creates, so authorizing only
+   * the identity ({@link ses.EmailIdentity.grantSendEmail}) is a silent under-grant: SES rejects the
+   * send when the caller lacks access to the config-set resource. This grants both by construction.
+   */
+  grantSendEmail(grantee) {
+    return iam18.Grant.addToPrincipal({
+      grantee,
+      actions: ["ses:SendEmail", "ses:SendRawEmail"],
+      resourceArns: [this.identity.emailIdentityArn, this.configurationSetArn]
+    });
+  }
 };
 function resolveSenderType(sender) {
   return sender.includes("@") ? "email" : "domain";

package/package.json

@@ -20,7 +20,7 @@
     "aws-cdk-lib": "^2.178.0",
     "esbuild": "^0.25.0"
   },
-  "version": "1.0.0-alpha.28",
+  "version": "1.0.0-alpha.29",
   "publishConfig": {
     "access": "public"
   },