@mettlecast/domain-cdk-packer 0.2.76 → 0.2.77

package/dist/DomainStack.js

@@ -173,6 +173,9 @@ export class DomainStack extends cdk.Stack {
         if (appSecretArn) {
             environment.APP_SECRET_ARN = appSecretArn;
         }
+        if (process.env['SES_FROM_EMAIL']) {
+            environment.SES_FROM_EMAIL = process.env['SES_FROM_EMAIL'];
+        }
         const resolveSubnetSelection = (access) => {
             if (access === 'internet')
                 return internetSubnetSelection ?? internalSubnetSelection;
@@ -547,6 +550,22 @@ export class DomainStack extends cdk.Stack {
                 }));
             }
         }
+        // Grant SES SendEmail permission when a verified sending address is configured.
+        // Scoped to the SES identity ARN derived from SES_FROM_EMAIL (e.g. an
+        // address or domain identity) — least-privilege. Falls back to 'arn:aws:ses:*:*:*'
+        // only when the address is not address-shaped (tests/local).
+        if (process.env['SES_FROM_EMAIL']) {
+            const sesFrom = process.env['SES_FROM_EMAIL'];
+            const sesIdentity = sesFrom.includes('@')
+                ? `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`
+                : `arn:aws:ses:${this.region}:${this.account}:identity/${sesFrom}`;
+            for (const fn of allDomainLambdas) {
+                fn.addToRolePolicy(new iam.PolicyStatement({
+                    actions: ['ses:SendEmail', 'ses:SendRawEmail'],
+                    resources: [sesIdentity],
+                }));
+            }
+        }
         // Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
         // Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
         const cfnRole = tenantScopedRole.node.defaultChild;

package/dist/pack-domain.d.ts

@@ -63,4 +63,4 @@ export interface PackDomainOptions {
  * @param options - Optional configuration including VPC, auth, and DB settings.
  * @returns The constructed DomainStack.
  */
-export declare function packDomain(registry: DomainRegistry, app: cdk.App, stackId: string, eventBusArn: string, options?: PackDomainOptions | cdk.Environment): DomainStack;
+export declare function packDomain(registry: DomainRegistry, app: cdk.App, stackId: string, eventBusArn: string, options?: PackDomainOptions): DomainStack;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.76",
+  "version": "0.2.77",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",