ethyca-fides 2.59.2rc1__py2.py3-none-any.whl → 2.60.0__py2.py3-none-any.whl

fides/api/schemas/connection_configuration/connection_secrets_google_cloud_sql_postgres.py

@@ -8,6 +8,9 @@ from fides.api.schemas.base_class import NoValidationSchema
 from fides.api.schemas.connection_configuration.connection_secrets import (
     ConnectionConfigSecretsSchema,
 )
+from fides.api.schemas.connection_configuration.enums.google_cloud_sql_ip_type import (
+    GoogleCloudSQLIPType,
+)
 
 
 class KeyfileCreds(BaseModel):
@@ -57,6 +60,11 @@ class GoogleCloudSQLPostgresSchema(ConnectionConfigSecretsSchema):
         json_schema_extra={"sensitive": True},
         description="The contents of the key file that contains authentication credentials for a service account in GCP.",
     )
+    ip_type: Optional[GoogleCloudSQLIPType] = Field(
+        default=None,
+        title="IP type",
+        description="Specify the IP Address type required for your database (defaults to public). See the Google Cloud documentation for more information about connection options: https://cloud.google.com/sql/docs/postgres/connect-overview",
+    )
 
     _required_components: ClassVar[List[str]] = [
         "db_iam_user",
@@ -71,6 +79,15 @@ class GoogleCloudSQLPostgresSchema(ConnectionConfigSecretsSchema):
             v = json.loads(v)
         return KeyfileCreds.model_validate(v)
 
+    @field_validator("ip_type", mode="before")
+    @classmethod
+    def empty_string_to_none(cls, v: Optional[str]) -> Optional[GoogleCloudSQLIPType]:
+        if v == "":
+            return None
+        if v is not None:
+            return GoogleCloudSQLIPType(v)
+        return v
+
 
 class GoogleCloudSQLPostgresDocsSchema(
     GoogleCloudSQLPostgresSchema, NoValidationSchema

fides/api/schemas/connection_configuration/connection_secrets_website.py

@@ -1,5 +1,5 @@
 from fideslang.validation import AnyHttpUrlString
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from fides.api.schemas.base_class import NoValidationSchema
 
@@ -7,7 +7,9 @@ from fides.api.schemas.base_class import NoValidationSchema
 class WebsiteSchema(BaseModel):
     """Schema to validate the secrets needed for a generic website connector"""
 
-    url: AnyHttpUrlString
+    url: AnyHttpUrlString = Field(
+        title="URL",
+    )
 
 
 class WebsiteDocsScehma(WebsiteSchema, NoValidationSchema):

fides/api/schemas/connection_configuration/enums/google_cloud_sql_ip_type.py

@@ -0,0 +1,9 @@
+from enum import Enum
+
+
+class GoogleCloudSQLIPType(str, Enum):
+    """Enum for Google Cloud SQL IP types"""
+
+    public = "public"
+    private = "private"
+    private_service_connect = "psc"

fides/api/schemas/messaging/messaging.py

@@ -286,12 +286,19 @@ class MessagingServiceDetailsTwilioEmail(BaseModel):
 class MessagingServiceDetailsAWS_SES(BaseModel):
     """The details required to represent an AWS SES email configuration."""
 
-    email_from: str
-    domain: str
+    email_from: Optional[str] = None
+    domain: Optional[str] = None
     aws_region: str
 
     model_config = ConfigDict(extra="forbid")
 
+    @model_validator(mode="before")
+    @classmethod
+    def validate_fields(cls, values: Dict[str, Any]) -> Dict[str, Any]:
+        if not values.get("domain") and not values.get("email_from"):
+            raise ValueError("Either 'email_from' or 'domain' must be provided.")
+        return values
+
 
 class MessagingServiceSecrets(Enum):
     """Enum for message service secrets"""

fides/api/schemas/storage/storage.py

@@ -61,6 +61,20 @@ class StorageDetailsS3(FileBasedStorageDetails):
     model_config = ConfigDict(use_enum_values=True)
 
 
+class GCSAuthMethod(str, Enum):
+    ADC = "adc"  # Application Default Credentials
+    SERVICE_ACCOUNT_KEYS = "service_account_keys"
+
+
+class StorageDetailsGCS(FileBasedStorageDetails):
+    """The details required to represent a Google Cloud Storage bucket."""
+
+    auth_method: GCSAuthMethod
+    bucket: str
+    max_retries: Optional[int] = 0
+    model_config = ConfigDict(use_enum_values=True)
+
+
 class StorageDetailsLocal(FileBasedStorageDetails):
     """The details required to configurate local storage configuration"""
 
@@ -71,6 +85,8 @@ class StorageSecrets(Enum):
     # s3-specific
     AWS_ACCESS_KEY_ID = "aws_access_key_id"
     AWS_SECRET_ACCESS_KEY = "aws_secret_access_key"
+    REGION_NAME = "region_name"
+    AWS_ASSUME_ROLE = "assume_role_arn"
 
 
 class StorageSecretsLocal(BaseModel):
@@ -80,10 +96,27 @@ class StorageSecretsLocal(BaseModel):
 
 
 class StorageSecretsS3(BaseModel):
-    """The secrets required to connect to an S3 bucket."""
+    aws_access_key_id: Optional[str] = None
+    aws_secret_access_key: Optional[str] = None
+    region_name: Optional[str] = None
+    assume_role_arn: Optional[str] = None
+    model_config = ConfigDict(extra="forbid")
+
 
-    aws_access_key_id: str
-    aws_secret_access_key: str
+class StorageSecretsGCS(BaseModel):
+    """The secrets required to connect to a Google Cloud Storage bucket."""
+
+    type: str = "service_account"
+    project_id: str
+    private_key_id: str
+    private_key: str
+    client_email: str
+    client_id: str
+    auth_uri: str
+    token_uri: str
+    auth_provider_x509_cert_url: str
+    client_x509_cert_url: str
+    universe_domain: str
     model_config = ConfigDict(extra="forbid")
 
 
@@ -99,6 +132,7 @@ class StorageType(Enum):
 
 FULLY_CONFIGURED_STORAGE_TYPES = (
     StorageType.s3,
+    StorageType.gcs,
 )  # storage types that are considered "fully configured"
 
 
@@ -108,6 +142,7 @@ class StorageDestinationBase(BaseModel):
     type: StorageType
     details: Union[
         StorageDetailsS3,
+        StorageDetailsGCS,
         StorageDetailsLocal,
     ] = Field(validate_default=True)
     format: Optional[ResponseFormat] = ResponseFormat.json.value  # type: ignore
@@ -145,6 +180,7 @@ class StorageDestinationBase(BaseModel):
         try:
             schema = {
                 StorageType.s3.value: StorageDetailsS3,
+                StorageType.gcs.value: StorageDetailsGCS,
                 StorageType.local.value: StorageDetailsLocal,
             }[storage_type]
         except KeyError:
@@ -209,7 +245,7 @@ class BulkPutStorageConfigResponse(BulkResponse):
     failed: List[BulkUpdateFailed] = []
 
 
-SUPPORTED_STORAGE_SECRETS = StorageSecretsS3
+SUPPORTED_STORAGE_SECRETS = Union[StorageSecretsS3, StorageSecretsGCS]
 
 
 class StorageConfigStatus(Enum):

fides/api/schemas/storage/storage_secrets_docs_only.py

@@ -1,9 +1,15 @@
+from typing import Union
+
 from fides.api.schemas.base_class import NoValidationSchema
-from fides.api.schemas.storage.storage import StorageSecretsS3
+from fides.api.schemas.storage.storage import StorageSecretsGCS, StorageSecretsS3
 
 
 class StorageSecretsS3Docs(StorageSecretsS3, NoValidationSchema):
     """The secrets required to connect to S3, for documentation"""
 
 
-possible_storage_secrets = StorageSecretsS3Docs
+class StorageSecretsGCSDocs(StorageSecretsGCS, NoValidationSchema):
+    """The secrets required to connect to Google Cloud Storage, for documentation"""
+
+
+possible_storage_secrets = Union[StorageSecretsS3Docs, StorageSecretsGCSDocs]

fides/api/schemas/system.py

@@ -1,7 +1,7 @@
 from datetime import datetime
 from typing import Any, Dict, List, Optional, Sequence
 
-from fideslang.models import Cookies, PrivacyDeclaration, System
+from fideslang.models import PrivacyDeclaration, System
 from pydantic import ConfigDict, Field
 from pydantic.main import BaseModel
 
@@ -17,7 +17,6 @@ class PrivacyDeclarationResponse(PrivacyDeclaration):
     id: str = Field(
         description="The database-assigned ID of the privacy declaration on the system. This is meant to be a read-only field, returned only in API responses"
     )
-    cookies: Optional[List[Cookies]] = []
 
 
 class BasicSystemResponse(System):

fides/api/service/connectors/google_cloud_mysql_connector.py

@@ -8,6 +8,9 @@ from sqlalchemy.engine import Engine, LegacyCursorResult, create_engine  # type:
 from fides.api.schemas.connection_configuration.connection_secrets_google_cloud_sql_mysql import (
     GoogleCloudSQLMySQLSchema,
 )
+from fides.api.schemas.connection_configuration.enums.google_cloud_sql_ip_type import (
+    GoogleCloudSQLIPType,
+)
 from fides.api.service.connectors.sql_connector import SQLConnector
 from fides.api.util.collection_util import Row
 from fides.config import get_config
@@ -37,6 +40,7 @@ class GoogleCloudSQLMySQLConnector(SQLConnector):
             conn: pymysql.connections.Connection = connector.connect(
                 config.instance_connection_name,
                 "pymysql",
+                ip_type=config.ip_type or GoogleCloudSQLIPType.public,
                 user=config.db_iam_user,
                 db=config.dbname,
                 enable_iam_auth=True,

fides/api/service/connectors/google_cloud_postgres_connector.py

@@ -16,6 +16,9 @@ from fides.api.graph.execution import ExecutionNode
 from fides.api.schemas.connection_configuration.connection_secrets_google_cloud_sql_postgres import (
     GoogleCloudSQLPostgresSchema,
 )
+from fides.api.schemas.connection_configuration.enums.google_cloud_sql_ip_type import (
+    GoogleCloudSQLIPType,
+)
 from fides.api.service.connectors.query_configs.google_cloud_postgres_query_config import (
     GoogleCloudSQLPostgresQueryConfig,
 )
@@ -53,6 +56,7 @@ class GoogleCloudSQLPostgresConnector(SQLConnector):
             conn: pg8000.dbapi.Connection = connector.connect(
                 config.instance_connection_name,
                 "pg8000",
+                ip_type=config.ip_type or GoogleCloudSQLIPType.public,
                 user=config.db_iam_user,
                 db=config.dbname or self.default_db_name,
                 enable_iam_auth=True,

fides/api/service/connectors/sql_connector.py

@@ -119,8 +119,8 @@ class SQLConnector(BaseConnector[Engine]):
             )
         except ClientResponseError as e:
             raise ConnectionException(f"Connection error: {e.message}")
-        except Exception:
-            raise ConnectionException("Connection error.")
+        except Exception as exc:
+            raise ConnectionException(f"Connection error: {exc}")
 
         return ConnectionTestStatus.succeeded
 

fides/api/service/storage/gcs.py

@@ -0,0 +1,38 @@
+from typing import Dict, Optional
+
+from google.cloud.storage import Client  # type: ignore
+from google.oauth2 import service_account
+from loguru import logger
+
+from fides.api.common_exceptions import StorageUploadError
+from fides.api.schemas.storage.storage import GCSAuthMethod
+
+
+def get_gcs_client(
+    auth_method: str,
+    storage_secrets: Optional[Dict],
+) -> Client:
+    """
+    Abstraction to retrieve a GCS client using secrets.
+    """
+    if auth_method == GCSAuthMethod.ADC.value:
+        storage_client = Client()
+
+    elif auth_method == GCSAuthMethod.SERVICE_ACCOUNT_KEYS.value:
+        if not storage_secrets:
+            err_msg = "Storage secrets not found for Google Cloud Storage."
+            logger.warning(err_msg)
+            raise StorageUploadError(err_msg)
+
+        credentials = service_account.Credentials.from_service_account_info(
+            dict(storage_secrets)
+        )
+        storage_client = Client(credentials=credentials)
+
+    else:
+        logger.error("Google Cloud Storage auth method not supported: {}", auth_method)
+        raise ValueError(
+            f"Google Cloud Storage auth method not supported: {auth_method}"
+        )
+
+    return storage_client

fides/api/service/storage/storage_authenticator_service.py

@@ -1,7 +1,12 @@
-from typing import Any, Dict, Union
+from typing import Any
 
 from botocore.exceptions import ClientError
+from google.auth.exceptions import GoogleAuthError
+from google.auth.transport.requests import Request
+from google.oauth2 import service_account
+from loguru import logger
 
+from fides.api.models.storage import StorageConfig
 from fides.api.schemas.storage.storage import (
     SUPPORTED_STORAGE_SECRETS,
     AWSAuthMethod,
@@ -13,32 +18,50 @@ from fides.api.util.aws_util import get_aws_session
 
 def secrets_are_valid(
     secrets: SUPPORTED_STORAGE_SECRETS,
-    storage_type: Union[StorageType, str],
+    storage_config: StorageConfig,
 ) -> bool:
     """Authenticates upload destination with appropriate upload method"""
-    if not isinstance(storage_type, StorageType):
-        # try to coerce into an enum
-        try:
-            storage_type = StorageType[storage_type]
-        except KeyError:
-            raise ValueError(
-                "storage_type argument must be a valid StorageType enum member."
-            )
-    uploader: Any = _get_authenticator_from_config(storage_type)
-    return uploader(secrets)
-
-
-def _s3_authenticator(secrets: Dict[StorageSecrets, Any]) -> bool:
+    uploader: Any = _get_authenticator_from_config(storage_config.type)  # type: ignore
+    return uploader(storage_config, secrets)
+
+
+def _s3_authenticator(
+    config: StorageConfig, secrets: dict[StorageSecrets, Any]
+) -> bool:
     """Authenticates secrets for s3, returns true if secrets are valid"""
     try:
-        get_aws_session(AWSAuthMethod.SECRET_KEYS.value, secrets.model_dump(mode="json"))  # type: ignore
+        get_aws_session(config.details["auth_method"] or AWSAuthMethod.SECRET_KEYS.value, secrets.model_dump(mode="json"))  # type: ignore
         return True
     except ClientError:
         return False
 
 
+def _gcs_authenticator(storage_config: StorageConfig, secrets: dict) -> bool:
+    """Autenticates secrets for Google Cloud Storage, returns true if secrets are valid"""
+    try:
+        credentials = service_account.Credentials.from_service_account_info(
+            dict(secrets),
+            scopes=["https://www.googleapis.com/auth/devstorage.read_only"],
+        )
+        # To validate the credentials, it is necessary to make a request to Google Cloud API
+        credentials.refresh(Request())
+        return True
+
+    except GoogleAuthError as auth_error:
+        logger.warning(
+            "Google authentication error trying to authenticate GCS secrets: {}",
+            auth_error,
+        )
+        return False
+
+    except Exception as e:
+        logger.warning("Unexpected error authenticating GCS secrets: {}", e)
+        return False
+
+
 def _get_authenticator_from_config(storage_type: StorageType) -> Any:
     """Determines which uploader method to use based on storage type"""
     return {
         StorageType.s3.value: _s3_authenticator,
+        StorageType.gcs.value: _gcs_authenticator,
     }[storage_type.value]

fides/api/service/storage/storage_uploader_service.py

@@ -14,7 +14,7 @@ from fides.api.schemas.storage.storage import (
     StorageDetails,
     StorageType,
 )
-from fides.api.tasks.storage import upload_to_local, upload_to_s3
+from fides.api.tasks.storage import upload_to_gcs, upload_to_local, upload_to_s3
 
 
 def upload(
@@ -78,6 +78,7 @@ def _get_uploader_from_config_type(storage_type: StorageType) -> Any:
     return {
         StorageType.s3.value: _s3_uploader,
         StorageType.local.value: _local_uploader,
+        StorageType.gcs.value: _gcs_uploader,
     }[storage_type.value]
 
 
@@ -106,6 +107,29 @@ def _s3_uploader(
     )
 
 
+def _gcs_uploader(
+    _: Session,
+    config: StorageConfig,
+    data: Dict,
+    privacy_request: PrivacyRequest,
+) -> str:
+    """Constructs necessary info needed for Google Cloud Storage before calling upload"""
+    file_key: str = _construct_file_key(privacy_request.id, config)
+
+    bucket_name = config.details[StorageDetails.BUCKET.value]
+    auth_method = config.details[StorageDetails.AUTH_METHOD.value]
+
+    return upload_to_gcs(
+        config.secrets,
+        data,
+        bucket_name,
+        file_key,
+        config.format.value,  # type: ignore
+        privacy_request,
+        auth_method,
+    )
+
+
 def _local_uploader(
     _: Session,
     config: StorageConfig,

fides/api/tasks/storage.py

@@ -16,6 +16,7 @@ from fides.api.schemas.storage.storage import ResponseFormat, StorageSecrets
 from fides.api.service.privacy_request.dsr_package.dsr_report_builder import (
     DsrReportBuilder,
 )
+from fides.api.service.storage.gcs import get_gcs_client
 from fides.api.service.storage.s3 import (
     create_presigned_url_for_s3,
     generic_upload_to_s3,
@@ -64,7 +65,7 @@ def encrypt_access_request_results(data: Union[str, bytes], request_id: str) ->
 def write_to_in_memory_buffer(
     resp_format: str, data: Dict[str, Any], privacy_request: PrivacyRequest
 ) -> BytesIO:
-    """Write JSON/CSV data to in-memory file-like object to be passed to S3. Encrypt data if encryption key/nonce
+    """Write JSON/CSV data to in-memory file-like object to be passed to S3 or GCS. Encrypt data if encryption key/nonce
     has been cached for the given privacy request id
 
     :param resp_format: str, should be one of ResponseFormat
@@ -130,7 +131,13 @@ def upload_to_s3(  # pylint: disable=R0913
         raise ValueError("Privacy request must be provided")
 
     try:
-        s3_client = get_s3_client(auth_method, storage_secrets)
+        s3_client = get_s3_client(
+            auth_method,
+            storage_secrets,
+            assume_role_arn=CONFIG.credentials.get(  # pylint: disable=no-member
+                "storage", {}
+            ).get("aws_s3_assume_role_arn"),
+        )
 
         # handles file chunking
         try:
@@ -157,6 +164,49 @@ def upload_to_s3(  # pylint: disable=R0913
         raise ValueError(f"The parameters you provided are incorrect: {e}")
 
 
+def upload_to_gcs(
+    storage_secrets: Dict,
+    data: Dict,
+    bucket_name: str,
+    file_key: str,
+    resp_format: str,
+    privacy_request: PrivacyRequest,
+    auth_method: str,
+) -> str:
+    """Uploads access request data to a Google Cloud Storage bucket"""
+    logger.info("Starting Google Cloud Storage upload of {}", file_key)
+
+    try:
+        storage_client = get_gcs_client(auth_method, storage_secrets)
+        bucket = storage_client.bucket(bucket_name)
+
+        blob = bucket.blob(file_key)
+        in_memory_file = write_to_in_memory_buffer(resp_format, data, privacy_request)
+        content_type = {
+            ResponseFormat.json.value: "application/json",
+            ResponseFormat.csv.value: "application/zip",
+            ResponseFormat.html.value: "application/zip",
+        }
+        blob.upload_from_string(
+            in_memory_file.getvalue(), content_type=content_type[resp_format]
+        )
+
+        logger.info("File {} uploaded to {}", file_key, blob.public_url)
+
+        presigned_url = blob.generate_signed_url(
+            version="v4",
+            expiration=CONFIG.security.subject_request_download_link_ttl_seconds,
+            method="GET",
+        )
+        return presigned_url
+    except Exception as e:
+        logger.error(
+            "Encountered error while uploading and generating link for Google Cloud Storage object: {}",
+            e,
+        )
+        raise e
+
+
 def upload_to_local(
     data: Dict,
     file_key: str,

fides/api/util/aws_util.py

@@ -22,6 +22,10 @@ def get_aws_session(
     if storage_secrets is None:
         # set to an empty dict to allow for more dynamic code downstream
         storage_secrets = {}
+
+    stored_region_name = storage_secrets.get("region_name")  # type: ignore
+    stored_assume_role_arn: Optional[str] = storage_secrets.get("assume_role_arn")  # type: ignore
+
     if auth_method == AWSAuthMethod.SECRET_KEYS.value:
         if not storage_secrets:
             err_msg = "Storage secrets not found for S3 storage."
@@ -33,12 +37,10 @@ def get_aws_session(
             aws_secret_access_key=storage_secrets[
                 StorageSecrets.AWS_SECRET_ACCESS_KEY.value  # type: ignore
             ],
-            region_name=storage_secrets.get("region_name"),  # type: ignore
+            region_name=stored_region_name,
         )
     elif auth_method == AWSAuthMethod.AUTOMATIC.value:
-        session = Session(
-            region_name=storage_secrets.get("region_name"),  # type: ignore
-        )
+        session = Session(region_name=stored_region_name)
         logger.info("Successfully created automatic session")
     else:
         logger.error("AWS auth method not supported: {}", auth_method)
@@ -48,20 +50,13 @@ def get_aws_session(
     sts_client = session.client("sts")
     sts_client.get_caller_identity()
 
-    if assume_role_arn:
+    target_assume_role_arn = assume_role_arn or stored_assume_role_arn
+    if target_assume_role_arn:
         try:
-            response = sts_client.assume_role(
-                RoleArn=assume_role_arn, RoleSessionName="FidesAssumeRoleSession"
-            )
-            temp_credentials = response["Credentials"]
-            logger.info(
-                f"Assumed role {assume_role_arn} and got temporary credentials."
-            )
-            return Session(
-                aws_access_key_id=temp_credentials["AccessKeyId"],
-                aws_secret_access_key=temp_credentials["SecretAccessKey"],
-                aws_session_token=temp_credentials["SessionToken"],
-                region_name=storage_secrets.get("region_name"),  # type: ignore
+            return get_assumed_role_session(
+                target_assume_role_arn,
+                sts_client,
+                stored_region_name,
             )
         except ClientError as error:
             logger.exception(
@@ -72,6 +67,22 @@ def get_aws_session(
         return session
 
 
+def get_assumed_role_session(
+    assume_role_arn: str, sts_client: Any, region_name: Optional[str] = None
+) -> Session:
+    response = sts_client.assume_role(
+        RoleArn=assume_role_arn, RoleSessionName="FidesAssumeRoleSession"
+    )
+    temp_credentials = response["Credentials"]
+    logger.info(f"Assumed role {assume_role_arn} and got temporary credentials.")
+    return Session(
+        aws_access_key_id=temp_credentials["AccessKeyId"],
+        aws_secret_access_key=temp_credentials["SecretAccessKey"],
+        aws_session_token=temp_credentials["SessionToken"],
+        region_name=region_name,
+    )
+
+
 def get_s3_client(
     auth_method: str,
     storage_secrets: Optional[Dict[StorageSecrets, Any]],

fides/api/util/storage_util.py

@@ -6,6 +6,7 @@ from pydantic import ValidationError
 
 from fides.api.schemas.storage.storage import (
     SUPPORTED_STORAGE_SECRETS,
+    StorageSecretsGCS,
     StorageSecretsS3,
     StorageType,
 )
@@ -31,6 +32,7 @@ def get_schema_for_secrets(
     try:
         schema = {
             StorageType.s3: StorageSecretsS3,
+            StorageType.gcs: StorageSecretsGCS,
         }[storage_type]
     except KeyError:
         raise ValueError(

fides/service/messaging/aws_ses_service.py

@@ -97,27 +97,29 @@ class AWS_SES_Service:
 
     def validate_email_and_domain_status(self) -> None:
         """
-        Validate that the email and domain are verified in SES.
+        Validate that either the email or domain (or both) are verified in SES.
         """
         email = self.messaging_config_details.email_from
         domain = self.messaging_config_details.domain
+        identities = list(filter(None, (email, domain)))
+
+        # Defensive code just in case, there should always be email_from or domain
+        if not identities:
+            raise AWS_SESException(
+                "No identity (email_from or domain) configured for SES validation."
+            )
 
         ses_client = self.get_ses_client()
         response = ses_client.get_identity_verification_attributes(
-            Identities=[email, domain]
-        )
-        email_status = (
-            response["VerificationAttributes"].get(email, {}).get("VerificationStatus")
-        )
-        domain_status = (
-            response["VerificationAttributes"].get(domain, {}).get("VerificationStatus")
+            Identities=identities
         )
-        if email_status != "Success":
-            logger.error(f"Email {email} is not verified in SES.")
-            raise AWS_SESException(f"Email {email} is not verified in SES.")
-        if domain_status != "Success":
-            logger.error(f"Domain {domain} is not verified in SES.")
-            raise AWS_SESException(f"Domain {domain} is not verified in SES.")
+        attributes = response.get("VerificationAttributes", {})
+
+        for identity in identities:
+            status = attributes.get(identity, {}).get("VerificationStatus")
+            if status != "Success":
+                logger.error(f"{identity} is not verified in SES.")
+                raise AWS_SESException(f"{identity} is not verified in SES.")
 
     def send_email(
         self,
@@ -127,13 +129,20 @@ class AWS_SES_Service:
     ) -> None:
         """
         Send an email using AWS SES.
-        Both the from_email and domain set in the messaging config must be verified in SES.
+        Either `email_from` or `domain` must be verified in SES.
         """
         self.validate_email_and_domain_status()
         ses_client = self.get_ses_client()
 
+        from_address = self.messaging_config_details.email_from
+        if not from_address:
+            # If there is no email_from, there is a domain, and the domain was verified against SES.
+            # When you verify a domain identity, you can send email from any subdomain or email address of the
+            # verified domain without having to verify each one individually.
+            from_address = f"noreply@{self.messaging_config_details.domain}"
+
         ses_client.send_email(
-            Source=self.messaging_config_details.email_from,
+            Source=from_address,
             Destination={"ToAddresses": [to.strip()]},
             Message={
                 "Subject": {"Data": subject},