AWS SESのバウンスを見やすい形でSlackに通知してみる

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  Prefix:
    Type: String
    Description: Prefix for SES
    Default: ses-bounce

  BounceSlackChannel:
    Type: String

  SlackWorkspace:
    Type: String

Resources:
  SESConfigurationSet:
    Type: "AWS::SES::ConfigurationSet"
    Properties:
      Name: !Sub "${Prefix}-configuration-set"
      SendingOptions:
        SendingEnabled: true

  SESEventDestinationEventBridge:
    Type: "AWS::SES::ConfigurationSetEventDestination"
    Properties:
      ConfigurationSetName: !Ref SESConfigurationSet
      EventDestination:
        Name: !Sub "${Prefix}-destination-eventbridge"
        Enabled: true
        MatchingEventTypes:
          - "bounce"
        EventBridgeDestination:
          EventBusArn: !Sub "arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default"

  SESBounceTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: "SES Bounce Topic"
      TopicName: !Sub "${Prefix}-ses-bounce-topic"

  SESBounceTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref SESBounceTopic
      PolicyDocument:
        Version: "2008-10-17"
        Statement:
          - Sid: "DefaultSNSPolicy"
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - SNS:GetTopicAttributes
              - SNS:SetTopicAttributes
              - SNS:AddPermission
              - SNS:RemovePermission
              - SNS:DeleteTopic
              - SNS:Subscribe
              - SNS:ListSubscriptionsByTopic
              - SNS:Publish
            Resource: !Ref SESBounceTopic
            Condition:
              StringEquals:
                AWS:SourceOwner: !Ref AWS::AccountId
          - Sid: "AllowEventBridgeToPublishToSNS"
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: SNS:Publish
            Resource: !Ref SESBounceTopic

  SESBounceEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub "${Prefix}-ses-bounce-rule"
      Description: "Rule to capture SES bounce events and notify via Chatbot"
      State: ENABLED
      EventPattern:
        source:
          - aws.ses
        detail-type:
          - "Email Bounced"
      Targets:
        - Arn: !Ref SESBounceTopic
          Id: "ses-bounce-topic"
          InputTransformer:
            InputPathsMap:
              bounceType: "$.detail.bounce.bounceType"
              bounceSubType: "$.detail.bounce.bounceSubType"
              emailAddress: "$.detail.bounce.bouncedRecipients[0].emailAddress"
              status: "$.detail.bounce.bouncedRecipients[0].status"
              diagnosticCode: "$.detail.bounce.bouncedRecipients[0].diagnosticCode"
              messageId: "$.detail.mail.messageId"
              source: "$.detail.mail.source"
              timestamp: "$.detail.bounce.timestamp"
              subject: "$.detail.mail.commonHeaders.subject"
            InputTemplate: |
              {
                "version":"1.0",
                "source":"custom",
                "content":{
                  "textType": "client-markdown",
                  "title":"📧 SES バウンスメール検知",
                  "description":"以下のメール送信でバウンスが発生しました\n\n*バウンス情報:*\n• バウンスタイプ: <bounceType>\n• バウンスサブタイプ: <bounceSubType>\n• エラーコード: <status>\n• エラー診断: <diagnosticCode>\n\n*送信情報:*\n• 送信元: <source>\n• 送信先: <emailAddress>\n• 件名: <subject>\n• メッセージID: <messageId>\n• 発生時刻: <timestamp>",
                  "nextSteps":[
                    "バウンスタイプに応じて以下の対応を検討してください:",
                    "- Permanent: 送信先アドレスの無効化や修正",
                    "- Transient: 一時的な問題として監視"
                  ]
                }
              }

  EventBridgeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: ChatbotInvokePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - chatbot:*
                Resource: "*"

  ChatbotSlackBounceChannel:
    Type: AWS::Chatbot::SlackChannelConfiguration
    Properties:
      ConfigurationName: !Sub "${Prefix}-bounce-notification"
      IamRoleArn: !GetAtt ChatbotRole.Arn
      SlackChannelId: !Ref BounceSlackChannel
      SlackWorkspaceId: !Ref SlackWorkspace
      GuardrailPolicies:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"
      SnsTopicArns:
        - !Ref SESBounceTopic

  ChatbotRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - chatbot.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess

/invite @aws