@mavogel/awscdk-rootmail 0.0.336 → 0.1.0

package/.jsii

@@ -13,13 +13,13 @@
     "@aws-sdk/client-s3": "^3.1083.0",
     "@aws-sdk/client-ses": "^3.1083.0",
     "@aws-sdk/client-ssm": "^3.1083.0",
-    "cdk-nag": "^2.37.55",
+    "cdk-nag": "^3.0.1",
     "mailparser": "^3.9.14",
     "uuid": "^14.0.1"
   },
   "dependencies": {
-    "@mavogel/mvc-projen": "^0.0.25",
-    "aws-cdk-lib": "^2.243.0",
+    "@mavogel/mvc-projen": "^0.0.30",
+    "aws-cdk-lib": "^2.263.0",
     "constructs": "^10.5.1"
   },
   "dependencyClosure": {
@@ -108,7 +108,7 @@
     "@mavogel/mvc-projen": {
       "targets": {
         "go": {
-          "moduleName": "github.com/MV-Consulting/mvc-projen"
+          "moduleName": "github.com/mavogel/mvc-projen"
         },
         "js": {
           "npm": "@mavogel/mvc-projen"
@@ -550,6 +550,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_awsexternalanthropic": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.AWSExternalAnthropic"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.awsexternalanthropic"
+            },
+            "python": {
+              "module": "aws_cdk.aws_awsexternalanthropic"
+            }
+          }
+        },
         "aws-cdk-lib.aws_b2bi": {
           "targets": {
             "dotnet": {
@@ -615,6 +628,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_bcmpricingcalculator": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.BcmPricingCalculator"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.bcmpricingcalculator"
+            },
+            "python": {
+              "module": "aws_cdk.aws_bcmpricingcalculator"
+            }
+          }
+        },
         "aws-cdk-lib.aws_bedrock": {
           "targets": {
             "dotnet": {
@@ -667,6 +693,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_braket": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Braket"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.braket"
+            },
+            "python": {
+              "module": "aws_cdk.aws_braket"
+            }
+          }
+        },
         "aws-cdk-lib.aws_budgets": {
           "targets": {
             "dotnet": {
@@ -745,6 +784,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_chime": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Chime"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.chime"
+            },
+            "python": {
+              "module": "aws_cdk.aws_chime"
+            }
+          }
+        },
         "aws-cdk-lib.aws_cleanrooms": {
           "targets": {
             "dotnet": {
@@ -1123,6 +1175,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_controlcatalog": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.ControlCatalog"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.controlcatalog"
+            },
+            "python": {
+              "module": "aws_cdk.aws_controlcatalog"
+            }
+          }
+        },
         "aws-cdk-lib.aws_controltower": {
           "targets": {
             "dotnet": {
@@ -1175,6 +1240,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_dataexchange": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.DataExchange"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.dataexchange"
+            },
+            "python": {
+              "module": "aws_cdk.aws_dataexchange"
+            }
+          }
+        },
         "aws-cdk-lib.aws_datapipeline": {
           "targets": {
             "dotnet": {
@@ -1623,6 +1701,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_elementalinference": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.ElementalInference"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.elementalinference"
+            },
+            "python": {
+              "module": "aws_cdk.aws_elementalinference"
+            }
+          }
+        },
         "aws-cdk-lib.aws_emr": {
           "targets": {
             "dotnet": {
@@ -2039,6 +2130,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_interconnect": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Interconnect"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.interconnect"
+            },
+            "python": {
+              "module": "aws_cdk.aws_interconnect"
+            }
+          }
+        },
         "aws-cdk-lib.aws_internetmonitor": {
           "targets": {
             "dotnet": {
@@ -2819,6 +2923,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_novaact": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.NovaAct"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.novaact"
+            },
+            "python": {
+              "module": "aws_cdk.aws_novaact"
+            }
+          }
+        },
         "aws-cdk-lib.aws_oam": {
           "targets": {
             "dotnet": {
@@ -2949,6 +3066,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_outposts": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Outposts"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.outposts"
+            },
+            "python": {
+              "module": "aws_cdk.aws_outposts"
+            }
+          }
+        },
         "aws-cdk-lib.aws_panorama": {
           "targets": {
             "dotnet": {
@@ -3222,6 +3352,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_resiliencehubv2": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.ResilienceHubV2"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.resiliencehubv2"
+            },
+            "python": {
+              "module": "aws_cdk.aws_resiliencehubv2"
+            }
+          }
+        },
         "aws-cdk-lib.aws_resourceexplorer2": {
           "targets": {
             "dotnet": {
@@ -3313,6 +3456,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_route53globalresolver": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.Route53GlobalResolver"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.route53globalresolver"
+            },
+            "python": {
+              "module": "aws_cdk.aws_route53globalresolver"
+            }
+          }
+        },
         "aws-cdk-lib.aws_route53profiles": {
           "targets": {
             "dotnet": {
@@ -3472,6 +3628,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_s3files": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.S3Files"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.s3files"
+            },
+            "python": {
+              "module": "aws_cdk.aws_s3files"
+            }
+          }
+        },
         "aws-cdk-lib.aws_s3objectlambda": {
           "targets": {
             "dotnet": {
@@ -3602,6 +3771,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_securityagent": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.SecurityAgent"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.securityagent"
+            },
+            "python": {
+              "module": "aws_cdk.aws_securityagent"
+            }
+          }
+        },
         "aws-cdk-lib.aws_securityhub": {
           "targets": {
             "dotnet": {
@@ -3953,6 +4135,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_uxc": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.UXC"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.uxc"
+            },
+            "python": {
+              "module": "aws_cdk.aws_uxc"
+            }
+          }
+        },
         "aws-cdk-lib.aws_verifiedpermissions": {
           "targets": {
             "dotnet": {
@@ -4597,6 +4792,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_awsexternalanthropic": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.AWSExternalAnthropic"
+            },
+            "go": {
+              "packageName": "interfacesawsawsexternalanthropic"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.awsexternalanthropic"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_awsexternalanthropic"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_b2bi": {
           "targets": {
             "dotnet": {
@@ -4661,6 +4872,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_bcm": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.BCM"
+            },
+            "go": {
+              "packageName": "interfacesawsbcm"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.bcm"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_bcm"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_bcmdataexports": {
           "targets": {
             "dotnet": {
@@ -4677,6 +4904,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_bcmpricingcalculator": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.BcmPricingCalculator"
+            },
+            "go": {
+              "packageName": "interfacesawsbcmpricingcalculator"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.bcmpricingcalculator"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_bcmpricingcalculator"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_bedrock": {
           "targets": {
             "dotnet": {
@@ -4757,6 +5000,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_braket": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Braket"
+            },
+            "go": {
+              "packageName": "interfacesawsbraket"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.braket"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_braket"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_budgets": {
           "targets": {
             "dotnet": {
@@ -4853,6 +5112,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_chime": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Chime"
+            },
+            "go": {
+              "packageName": "interfacesawschime"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.chime"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_chime"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_cleanrooms": {
           "targets": {
             "dotnet": {
@@ -5253,6 +5528,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_controlcatalog": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.ControlCatalog"
+            },
+            "go": {
+              "packageName": "interfacesawscontrolcatalog"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.controlcatalog"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_controlcatalog"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_controltower": {
           "targets": {
             "dotnet": {
@@ -5317,6 +5608,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_dataexchange": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.DataExchange"
+            },
+            "go": {
+              "packageName": "interfacesawsdataexchange"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.dataexchange"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_dataexchange"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_datapipeline": {
           "targets": {
             "dotnet": {
@@ -5749,6 +6056,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_elementalinference": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.ElementalInference"
+            },
+            "go": {
+              "packageName": "interfacesawselementalinference"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.elementalinference"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_elementalinference"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_emr": {
           "targets": {
             "dotnet": {
@@ -6229,6 +6552,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_interconnect": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Interconnect"
+            },
+            "go": {
+              "packageName": "interfacesawsinterconnect"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.interconnect"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_interconnect"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_internetmonitor": {
           "targets": {
             "dotnet": {
@@ -7125,6 +7464,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_novaact": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.NovaAct"
+            },
+            "go": {
+              "packageName": "interfacesawsnovaact"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.novaact"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_novaact"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_oam": {
           "targets": {
             "dotnet": {
@@ -7285,6 +7640,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_outposts": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Outposts"
+            },
+            "go": {
+              "packageName": "interfacesawsoutposts"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.outposts"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_outposts"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_panorama": {
           "targets": {
             "dotnet": {
@@ -7621,6 +7992,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_resiliencehubv2": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.ResilienceHubV2"
+            },
+            "go": {
+              "packageName": "interfacesawsresiliencehubv2"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.resiliencehubv2"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_resiliencehubv2"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_resourceexplorer2": {
           "targets": {
             "dotnet": {
@@ -7701,6 +8088,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_route53globalresolver": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.Route53GlobalResolver"
+            },
+            "go": {
+              "packageName": "interfacesawsroute53globalresolver"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.route53globalresolver"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_route53globalresolver"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_route53profiles": {
           "targets": {
             "dotnet": {
@@ -7829,6 +8232,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_s3files": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.S3Files"
+            },
+            "go": {
+              "packageName": "interfacesawss3files"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.s3files"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_s3files"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_s3objectlambda": {
           "targets": {
             "dotnet": {
@@ -7973,6 +8392,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_securityagent": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.SecurityAgent"
+            },
+            "go": {
+              "packageName": "interfacesawssecurityagent"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.securityagent"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_securityagent"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_securityhub": {
           "targets": {
             "dotnet": {
@@ -8357,6 +8792,22 @@
             }
           }
         },
+        "aws-cdk-lib.interfaces.aws_uxc": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.Interfaces.UXC"
+            },
+            "go": {
+              "packageName": "interfacesawsuxc"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.interfaces.uxc"
+            },
+            "python": {
+              "module": "aws_cdk.interfaces.aws_uxc"
+            }
+          }
+        },
         "aws-cdk-lib.interfaces.aws_verifiedpermissions": {
           "targets": {
             "dotnet": {
@@ -8673,6 +9124,7 @@
         "projen.cdk": {},
         "projen.cdk8s": {},
         "projen.cdktf": {},
+        "projen.cdktn": {},
         "projen.circleci": {},
         "projen.github": {},
         "projen.github.workflows": {},
@@ -8728,11 +9180,11 @@
         "hasDefaultInterfaces": true
       }
     },
-    "tscRootDir": "src"
+    "tscRootDir": "/home/runner/work/awscdk-rootmail/awscdk-rootmail/src"
   },
   "name": "@mavogel/awscdk-rootmail",
   "readme": {
-    "markdown": "![Source](https://img.shields.io/github/stars/MV-Consulting/awscdk-rootmail?logo=github&label=GitHub%20Stars)\n[![Build Status](https://github.com/MV-Consulting/awscdk-rootmail/actions/workflows/build.yml/badge.svg)](https://github.com/MV-Consulting/awscdk-rootmail/actions/workflows/build.yml)\n[![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)\n[![Latest release](https://img.shields.io/github/release/MV-Consulting/awscdk-rootmail.svg)](https://github.com/MV-Consulting/awscdk-rootmail/releases)\n![GitHub](https://img.shields.io/github/license/MV-Consulting/awscdk-rootmail)\n[![npm](https://img.shields.io/npm/dt/@mavogel/awscdk-rootmail?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/awscdk-rootmail)\n[![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n\n# awscdk-rootmail\n\nA single email box for all your root user emails in all AWS accounts of the organization.\n- The cdk implementation and **adaption** of the [superwerker](https://superwerker.cloud/) rootmail feature.\n- See [here](docs/adrs/rootmail.md) for a detailed Architectural Decision Record ([ADR](https://adr.github.io/))\n\n## TL;DR ⚡\nEach AWS account needs one unique email address (the so-called \"AWS account root user email address\").\n\nAccess to these email addresses must be adequately secured since they provide privileged access to AWS accounts, such as account deletion procedures.\n\nThis is why you only need 1 mailing list for the AWS Management (formerly *root*) account,\nwe recommend the following pattern `aws-roots+<uuid>@mycompany.test`\n\n> [!NOTE]\n> Maximum **64** characters are allowed for the whole address.\n\nAnd as you own the domain `mycompany.test` you can add a subdomain, e.g. `aws`, for which all EMails will then be received with this solution within this particular AWS Management account.\n\nFeel free to take a look at the design\n![rootmail-solution-diagram-v1](docs/img/awscdk-rootmail-v1-min.png)\n\n## Usage ✨\n\nInstall the dependencies:\n```sh\nbrew install aws-cli node@18 esbuild\n```\n\nYou can chose via embedding the construct in your cdk-app or use is directly via Cloudformation.\n### cdk 🤖\n1. To start a new project we recommend using [projen](https://projen.io/).\n   1. Create a new projen project\n   ```sh\n   npx projen new awscdk-app-ts\n   ```\n   2. Add `@mavogel/awscdk-rootmail` as a dependency to your project in the `.projenrc.ts` file\n   3. Run `yarn run projen` to install it\n2. In you `main.ts` file add the following code\n```ts\nimport { Rootmail } from '@mavogel/awscdk-rootmail';\nimport {\n  App,\n  Stack,\n  StackProps,\n  aws_route53 as r53,\n} from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.com' // registered via Route53 in the SAME account\n\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    new Rootmail(this, 'rootmail', {\n      // 1. a domain you own, registered via Route53 in the SAME account\n      domain: domain,\n      // 2. so the subdomain will be aws.mycompany.test and\n      subdomain: 'aws',\n      // 3. wired / delegated automatically to\n      wireDNSToHostedZoneID: hostedZone.hostedZoneId,\n    });\n  }\n}\n```\n2. run on your commandline\n```sh\nyarn run deploy\n```\n1. No need to do anything, the NS records are **automatically** propagated as the parent Hosted Zone is in the same account!\n2. The `hosted-zone-dkim-propagation-provider.is-complete-handler` Lambda function checks every 10 seconds if the DNS for the subdomain is propagated. Details are in the Cloudwatch log group.\n\n> [!TIP]\n> Take a look at the solution design [here](docs/adrs/solution-design-domain-same-aws-account.md) for more details.\n\n### cdk with your own receiver function 🏗️\nYou might also want to pass in you own function on what to do when an EMail is received\n\n> [!TIP]\n> You can add any custom code as receiver function you want.\n\n<details>\n  <summary>... click here for the details</summary>\n\nfile `functions/custom-ses-receive-function.ts` which gets the 2 environment variables populated\n- `EMAIL_BUCKET`\n- `EMAIL_BUCKET_ARN`\n\nas well as `s3:GetObject` on the `RootMail/*` objects in the created Rootmail `S3` bucket.\n\n```ts\nimport { S3 } from '@aws-sdk/client-s3';\nimport { ParsedMail, simpleParser } from 'mailparser';\n// populated by default\nconst emailBucket = process.env.EMAIL_BUCKET;\nconst emailBucketArn = process.env.EMAIL_BUCKET_ARN;\nconst s3 = new S3();\n\n// SESEventRecordsToLambda\n// from https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-lambda-event.html\nexport const handler = async (event: SESEventRecordsToLambda) => {\n    for (const record of event.Records) {\n\n        const id = record.ses.mail.messageId;\n        const key = `RootMail/${id}`;\n        const response = await s3.getObject({ Bucket: emailBucket as string, Key: key });\n\n        const msg: ParsedMail = await simpleParser(response.Body as unknown as Buffer);\n\n        let title = msg.subject;\n        console.log(`Title: ${title} from emailBucketArn: ${emailBucketArn}`);\n        // use the content of the email body\n        const body = msg.html;\n        // add your custom code here ...\n\n        // dummy example: list s3 buckets\n        const buckets = await s3.listBuckets({});\n        if (!buckets.Buckets) {\n            console.log('No buckets found');\n            return;\n        }\n        console.log('Buckets:');\n        for (const bucket of buckets.Buckets || []) {\n            console.log(bucket.Name);\n        }\n    }\n\n};\n```\nand you create a separate `NodejsFunction` as follows with the additionally needed IAM permissions:\n```ts\nconst customSesReceiveFunction = new NodejsFunction(stackUnderTest, 'custom-ses-receive-function', {\n  functionName: PhysicalName.GENERATE_IF_NEEDED,\n  entry: path.join(__dirname, 'functions', 'custom-ses-receive-function.ts'),\n  runtime: lambda.Runtime.NODEJS_18_X,\n  logRetention: 1,\n  timeout: Duration.seconds(30),\n});\n\n// Note: any additional permissions you need to add to the function yourself!\ncustomSesReceiveFunction.addToRolePolicy(new iam.PolicyStatement({\n  actions: [\n    's3:List*',\n  ],\n  resources: ['*'],\n}))\n```\nand then pass it into the `Rootmail` Stack\n```ts\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.test'\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    const rootmail = new Rootmail(this, 'rootmail-stack', {\n      domain: domain;\n      autowireDNSParentHostedZoneID: hostedZone.hostedZoneId,\n      env: {\n        region: 'eu-west-1',\n      },\n      customSesReceiveFunction: customSesReceiveFunction, // <- pass it in here\n    });\n  }\n}\n```\n\n\n> [!TIP]\n> Take a look at the solution design for external DNS [here](docs/adrs/solution-design-external-dns-provider.md) for more details.\n\n</details>\n\n### Cloudformation 📦\nor use it directly a Cloudformation template `yaml` from the URL [here](https://mvc-prod-releases.s3.eu-central-1.amazonaws.com/rootmail/v0.0.258/awscdk-rootmail.template.yaml).\n\n\n<details>\n  <summary>... click here for the details</summary>\n\nand fill out the parameters\n![cloudformation-template](docs/img/cloudformation-tpl-min.png)\n\n</details>\n\n\n## Known issues\n- [jsii/2071](https://github.com/aws/jsii/issues/2071): so adding  `compilerOptions.\"esModuleInterop\": true,` in `tsconfig.json` is not possible. See aws-cdk usage with[typescript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/#Usage_with_TypeScript). So we needed to change import from `import AWS from 'aws-sdk';` -> `import * as AWS from 'aws-sdk';` to be able to compile.\n\n## Related projects / questions\n- [aws-account-factory-email](https://github.com/aws-samples/aws-account-factory-email): a similar approach with SES, however you need to manually configure it upfront and also it about delivering root mails for a specific account to a specific mailing list and mainly decouples the real email address from the one of the AWS account. The main difference is that we do not *hide* or decouple the email address, but more make those as unique and unguessable/bruteforable as possible (with `uuids`).\n- The question `Is it best practise to use a shared mailbox as AWS root user address?` from [stackoverflow](https://stackoverflow.com/questions/76739635/is-it-best-practise-to-use-a-shared-mailbox-as-aws-root-user-address): yes of course you can also use `root+alias-1@mycompany.com` and `root+alias-2@mycompany.com` etc. for your\nroot EMail boxes.\n\n## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure\n\nHi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.\n\n---\n\n### 🌟 Why Work With Me?\n\n✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.\n✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.\n✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.\n✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.\n\n---\n\n### 🛠 What I Bring to the Table\n\n🔑 **12x AWS Certifications**\nI’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)\n\n⚙️ **Infrastructure as Code (IaC)**\nWith deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.\n\n📦 **DevOps Expertise**\nFrom CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.\n\n🌐 **Hands-On Experience**\nWith over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)\n\n---\n\n### 💼 Let’s Build Something Great Together\n\nI know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.\n\n✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.\n✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.\n✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.\n\n\n<a href=\"https://tinyurl.com/mvc-15min\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n\n---\n\n## 🙌 Acknowledgements\n\nBig shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!\nTheir groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
+    "markdown": "![Source](https://img.shields.io/github/stars/MV-Consulting/awscdk-rootmail?logo=github&label=GitHub%20Stars)\n[![Build Status](https://github.com/MV-Consulting/awscdk-rootmail/actions/workflows/build.yml/badge.svg)](https://github.com/MV-Consulting/awscdk-rootmail/actions/workflows/build.yml)\n[![ESLint Code Formatting](https://img.shields.io/badge/code_style-eslint-brightgreen.svg)](https://eslint.org)\n[![Latest release](https://img.shields.io/github/release/MV-Consulting/awscdk-rootmail.svg)](https://github.com/MV-Consulting/awscdk-rootmail/releases)\n![GitHub](https://img.shields.io/github/license/MV-Consulting/awscdk-rootmail)\n[![npm](https://img.shields.io/npm/dt/@mavogel/awscdk-rootmail?label=npm&color=orange)](https://www.npmjs.com/package/@mavogel/awscdk-rootmail)\n[![typescript](https://img.shields.io/badge/jsii-typescript-blueviolet.svg)](https://www.npmjs.com/package/@mavogel/cdk-vscode-server)\n\n# awscdk-rootmail\n\nA single email box for all your root user emails in all AWS accounts of the organization.\n- The cdk implementation and **adaption** of the [superwerker](https://superwerker.cloud/) rootmail feature.\n- See [here](docs/adrs/rootmail.md) for a detailed Architectural Decision Record ([ADR](https://adr.github.io/))\n\n## TL;DR ⚡\nEach AWS account needs one unique email address (the so-called \"AWS account root user email address\").\n\nAccess to these email addresses must be adequately secured since they provide privileged access to AWS accounts, such as account deletion procedures.\n\nThis is why you only need 1 mailing list for the AWS Management (formerly *root*) account,\nwe recommend the following pattern `aws-roots+<uuid>@mycompany.test`\n\n> [!NOTE]\n> Maximum **64** characters are allowed for the whole address.\n\nAnd as you own the domain `mycompany.test` you can add a subdomain, e.g. `aws`, for which all EMails will then be received with this solution within this particular AWS Management account.\n\nFeel free to take a look at the design\n![rootmail-solution-diagram-v1](docs/img/awscdk-rootmail-v1-min.png)\n\n## Usage ✨\n\nInstall the dependencies:\n```sh\nbrew install aws-cli node@18 esbuild\n```\n\nYou can chose via embedding the construct in your cdk-app or use is directly via Cloudformation.\n### cdk 🤖\n1. To start a new project we recommend using [projen](https://projen.io/).\n   1. Create a new projen project\n   ```sh\n   npx projen new awscdk-app-ts\n   ```\n   2. Add `@mavogel/awscdk-rootmail` as a dependency to your project in the `.projenrc.ts` file\n   3. Run `yarn run projen` to install it\n2. In you `main.ts` file add the following code\n```ts\nimport { Rootmail } from '@mavogel/awscdk-rootmail';\nimport {\n  App,\n  Stack,\n  StackProps,\n  aws_route53 as r53,\n} from 'aws-cdk-lib';\nimport { Construct } from 'constructs';\n\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.com' // registered via Route53 in the SAME account\n\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    new Rootmail(this, 'rootmail', {\n      // 1. a domain you own, registered via Route53 in the SAME account\n      domain: domain,\n      // 2. so the subdomain will be aws.mycompany.test and\n      subdomain: 'aws',\n      // 3. wired / delegated automatically to\n      wireDNSToHostedZoneID: hostedZone.hostedZoneId,\n    });\n  }\n}\n```\n2. run on your commandline\n```sh\nyarn run deploy\n```\n1. No need to do anything, the NS records are **automatically** propagated as the parent Hosted Zone is in the same account!\n2. The `hosted-zone-dkim-propagation-provider.is-complete-handler` Lambda function checks every 10 seconds if the DNS for the subdomain is propagated. Details are in the Cloudwatch log group.\n\n> [!TIP]\n> Take a look at the solution design [here](docs/adrs/solution-design-domain-same-aws-account.md) for more details.\n\n### cdk with your own receiver function 🏗️\nYou might also want to pass in you own function on what to do when an EMail is received\n\n> [!TIP]\n> You can add any custom code as receiver function you want.\n\n<details>\n  <summary>... click here for the details</summary>\n\nfile `functions/custom-ses-receive-function.ts` which gets the 2 environment variables populated\n- `EMAIL_BUCKET`\n- `EMAIL_BUCKET_ARN`\n\nas well as `s3:GetObject` on the `RootMail/*` objects in the created Rootmail `S3` bucket.\n\n```ts\nimport { S3 } from '@aws-sdk/client-s3';\nimport { ParsedMail, simpleParser } from 'mailparser';\n// populated by default\nconst emailBucket = process.env.EMAIL_BUCKET;\nconst emailBucketArn = process.env.EMAIL_BUCKET_ARN;\nconst s3 = new S3();\n\n// SESEventRecordsToLambda\n// from https://docs.aws.amazon.com/ses/latest/dg/receiving-email-action-lambda-event.html\nexport const handler = async (event: SESEventRecordsToLambda) => {\n    for (const record of event.Records) {\n\n        const id = record.ses.mail.messageId;\n        const key = `RootMail/${id}`;\n        const response = await s3.getObject({ Bucket: emailBucket as string, Key: key });\n\n        const msg: ParsedMail = await simpleParser(response.Body as unknown as Buffer);\n\n        let title = msg.subject;\n        console.log(`Title: ${title} from emailBucketArn: ${emailBucketArn}`);\n        // use the content of the email body\n        const body = msg.html;\n        // add your custom code here ...\n\n        // dummy example: list s3 buckets\n        const buckets = await s3.listBuckets({});\n        if (!buckets.Buckets) {\n            console.log('No buckets found');\n            return;\n        }\n        console.log('Buckets:');\n        for (const bucket of buckets.Buckets || []) {\n            console.log(bucket.Name);\n        }\n    }\n\n};\n```\nand you create a separate `NodejsFunction` as follows with the additionally needed IAM permissions:\n```ts\nconst customSesReceiveFunction = new NodejsFunction(stackUnderTest, 'custom-ses-receive-function', {\n  functionName: PhysicalName.GENERATE_IF_NEEDED,\n  entry: path.join(__dirname, 'functions', 'custom-ses-receive-function.ts'),\n  runtime: lambda.Runtime.NODEJS_24_X,\n  logRetention: 1,\n  timeout: Duration.seconds(30),\n});\n\n// Note: any additional permissions you need to add to the function yourself!\ncustomSesReceiveFunction.addToRolePolicy(new iam.PolicyStatement({\n  actions: [\n    's3:List*',\n  ],\n  resources: ['*'],\n}))\n```\nand then pass it into the `Rootmail` Stack\n```ts\nexport class MyStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps = {}) {\n    super(scope, id, props);\n\n    const domain = 'mycompany.test'\n    const hostedZone = r53.HostedZone.fromLookup(this, 'rootmail-parent-hosted-zone', {\n      domainName: domain,\n    });\n\n    const rootmail = new Rootmail(this, 'rootmail-stack', {\n      domain: domain;\n      autowireDNSParentHostedZoneID: hostedZone.hostedZoneId,\n      env: {\n        region: 'eu-west-1',\n      },\n      customSesReceiveFunction: customSesReceiveFunction, // <- pass it in here\n    });\n  }\n}\n```\n\n\n> [!TIP]\n> Take a look at the solution design for external DNS [here](docs/adrs/solution-design-external-dns-provider.md) for more details.\n\n</details>\n\n### Cloudformation 📦\nor use it directly a Cloudformation template `yaml` from the URL [here](https://mvc-prod-releases.s3.eu-central-1.amazonaws.com/rootmail/v0.0.258/awscdk-rootmail.template.yaml).\n\n\n<details>\n  <summary>... click here for the details</summary>\n\nand fill out the parameters\n![cloudformation-template](docs/img/cloudformation-tpl-min.png)\n\n</details>\n\n\n## Known issues\n- [jsii/2071](https://github.com/aws/jsii/issues/2071): so adding  `compilerOptions.\"esModuleInterop\": true,` in `tsconfig.json` is not possible. See aws-cdk usage with[typescript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/#Usage_with_TypeScript). So we needed to change import from `import AWS from 'aws-sdk';` -> `import * as AWS from 'aws-sdk';` to be able to compile.\n- Starting with this release, this construct requires `aws-cdk-lib` `>=2.263.0` and depends on `cdk-nag` `v3`, which replaced its suppression API (`NagSuppressions`) with CDK's native `Validations.of(construct).acknowledge(...)`. If you run `cdk-nag`'s `AwsSolutionsChecks` yourself against a stack containing this construct, be aware of the following gaps in what it can suppress on your behalf:\n  - `AwsSolutions-IAM4[Policy::...]` findings (AWS managed policies) cannot be acknowledged at all right now: `aws-cdk-lib`'s `Validations.acknowledge()` rejects any rule ID containing more than one `::`, and every AWS managed policy ARN contains one. This is a currently open upstream bug — see [cdklabs/cdk-nag#2359](https://github.com/cdklabs/cdk-nag/issues/2359) and [#2351](https://github.com/cdklabs/cdk-nag/issues/2351).\n  - `AwsSolutions-L1` (Lambda runtime), `AwsSolutions-SF1`/`SF2` (Step Functions logging/X-Ray on the internal custom-resource provider framework), and IAM findings on the shared `LogRetention` singleton are not suppressed by this construct — these were never checked before this release either.\n  - Granular `AwsSolutions-IAM5[Resource::<value>]` findings that embed a CDK-generated logical ID or your account/region are not portably suppressible by a shared construct library, since the acknowledged value is specific to how you instantiate `Rootmail` in your own app. Only the portable forms (`Resource::*`, a literal `Action::<name>`) are acknowledged internally.\n  - Synthesized CloudFormation templates no longer carry the v2-style `Metadata.cdk_nag.rules_to_suppress` block; acknowledgments are recorded as construct metadata instead. If you rely on that metadata for compliance tooling, run `cdk-nag` yourself with `writeSuppressionsToCloudFormation: true`.\n\n## Related projects / questions\n- [aws-account-factory-email](https://github.com/aws-samples/aws-account-factory-email): a similar approach with SES, however you need to manually configure it upfront and also it about delivering root mails for a specific account to a specific mailing list and mainly decouples the real email address from the one of the AWS account. The main difference is that we do not *hide* or decouple the email address, but more make those as unique and unguessable/bruteforable as possible (with `uuids`).\n- The question `Is it best practise to use a shared mailbox as AWS root user address?` from [stackoverflow](https://stackoverflow.com/questions/76739635/is-it-best-practise-to-use-a-shared-mailbox-as-aws-root-user-address): yes of course you can also use `root+alias-1@mycompany.com` and `root+alias-2@mycompany.com` etc. for your\nroot EMail boxes.\n\n## 🚀 Unlock the Full Potential of Your AWS Cloud Infrastructure\n\nHi, I’m Manuel, an AWS expert passionate about empowering businesses with **scalable, resilient, and cost-optimized cloud solutions**. With **MV Consulting**, I specialize in crafting **tailored AWS architectures** and **DevOps-driven workflows** that not only meet your current needs but grow with you.\n\n---\n\n### 🌟 Why Work With Me?\n\n✔️ **Tailored AWS Solutions:** Every business is unique, so I design custom solutions that fit your goals and challenges.\n✔️ **Well-Architected Designs:** From scalability to security, my solutions align with AWS Well-Architected Framework.\n✔️ **Cloud-Native Focus:** I specialize in modern, cloud-native systems that embrace the full potential of AWS.\n✔️ **Business-Driven Tech:** Technology should serve your business, not the other way around.\n\n---\n\n### 🛠 What I Bring to the Table\n\n🔑 **12x AWS Certifications**\nI’m **AWS Certified Solutions Architect and DevOps – Professional** and hold numerous additional certifications, so you can trust I’ll bring industry best practices to your projects. Feel free to explose by [badges](https://www.credly.com/users/manuel-vogel)\n\n⚙️ **Infrastructure as Code (IaC)**\nWith deep expertise in **AWS CDK** and **Terraform**, I ensure your infrastructure is automated, maintainable, and scalable.\n\n📦 **DevOps Expertise**\nFrom CI/CD pipelines with **GitHub Actions** and **GitLab CI** to container orchestration **Kubernetes** and others, I deliver workflows that are smooth and efficient.\n\n🌐 **Hands-On Experience**\nWith over **7 years of AWS experience** and a decade in the tech world, I’ve delivered solutions for companies large and small. My open-source contributions showcase my commitment to transparency and innovation. Feel free to explore my [GitHub profile](https://github.com/mavogel)\n\n---\n\n### 💼 Let’s Build Something Great Together\n\nI know that choosing the right partner is critical to your success. When you work with me, you’re not just contracting an engineer – you’re gaining a trusted advisor and hands-on expert who cares about your business as much as you do.\n\n✔️ **Direct Collaboration**: No middlemen or red tape – you work with me directly.\n✔️ **Transparent Process**: Expect open communication, clear timelines, and visible results.\n✔️ **Real Value**: My solutions focus on delivering measurable impact for your business.\n\n\n<a href=\"https://tinyurl.com/mvc-15min\"><img alt=\"Schedule your call\" src=\"https://img.shields.io/badge/schedule%20your%20call-success.svg?style=for-the-badge\"/></a>\n\n---\n\n## 🙌 Acknowledgements\n\nBig shoutout to the amazing team behind [Projen](https://github.com/projen/projen)!\nTheir groundbreaking work simplifies cloud infrastructure projects and inspires us every day. 💡\n\n## Author\n\n[Manuel Vogel](https://manuel-vogel.de/about/)\n\n[![](https://img.shields.io/badge/LinkedIn-0077B5?style=for-the-badge&logo=linkedin&logoColor=white)](https://www.linkedin.com/in/manuel-vogel)\n[![](https://img.shields.io/badge/GitHub-2b3137?style=for-the-badge&logo=github&logoColor=white)](https://github.com/mavogel)"
   },
   "repository": {
     "type": "git",
@@ -9165,6 +9617,6 @@
       "symbolId": "src/ses-receive:SESReceiveProps"
     }
   },
-  "version": "0.0.336",
-  "fingerprint": "Q914i/c73Uqd2oGxhhWzLGnpC3a99Wv4ihiWfkmpLt8="
+  "version": "0.1.0",
+  "fingerprint": "jJ0yoOEigTONSBFV9kLTpvspjak1lypfI1mJnogNAH8="
 }