Adds necessary resources for cognoma to send emails and write to s3.

main.tf

@@ -152,3 +152,82 @@ resource "aws_db_instance" "postgres-db" {
   vpc_security_group_ids = ["${aws_security_group.cognoma-db.id}"]
   multi_az = true
 }
+
+resource "aws_iam_user" "cognoma-server" {
+  name = "cognoma-server"
+}
+
+resource "aws_iam_user_policy" "ses-access" {
+  name = "ses-access"
+  user = "${aws_iam_user.cognoma-server.name}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["ses:SendEmail", "ses:SendRawEmail", "ses:GetSendQuota"],
+      "Resource":"*"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_access_key" "cognoma-server-access-key" {
+  user = "${aws_iam_user.cognoma-server.name}"
+}
+
+resource "aws_s3_bucket" "cognoma-files" {
+  bucket = "cognoma-files"
+
+  cors_rule {
+    allowed_origins = ["*"]
+    allowed_methods = ["GET"]
+    max_age_seconds = 3000
+    allowed_headers = ["Authorization"]
+  }
+
+  tags {
+    Name = "Cognoma Files"
+  }
+}
+
+data "aws_iam_policy_document" "cognoma-s3-access" {
+  statement {
+    actions = [
+      "s3:GetObject",
+    ]
+
+    resources = [
+      "arn:aws:s3:::${aws_s3_bucket.cognoma-files.id}/*",
+    ]
+
+    principals {
+      type = "AWS"
+      identifiers = ["*"]
+    }
+  }
+
+  statement {
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      "arn:aws:s3:::${aws_s3_bucket.cognoma-files.id}",
+      "arn:aws:s3:::${aws_s3_bucket.cognoma-files.id}/*",
+    ]
+
+    principals {
+      type = "AWS"
+      identifiers = ["${aws_iam_user.cognoma-server.arn}"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "cognoma-s3-policy" {
+  bucket = "${aws_s3_bucket.cognoma-files.id}"
+  policy = "${data.aws_iam_policy_document.cognoma-s3-access.json}"
+}

route53.tf

@@ -2,30 +2,46 @@
 #   name = "cognoma.org"
 # }
 
+variable "cognoma-domain" {
+  default = "cognoma.org"
+}
+
 data "aws_route53_zone" "cognoma" {
   zone_id = "Z2GDAYII3P3OEX"
 }
 
 resource "aws_route53_record" "cognoma-dot-org" {
   zone_id = "${data.aws_route53_zone.cognoma.zone_id}"
-  name    = "cognoma.org"
-  type    = "A"
-  ttl     = "300"
+  name = "${var.cognoma-domain}"
+  type = "A"
+  ttl = "300"
 
   records = [
     "192.30.252.153",
     "192.30.252.153",
   ]
 }
 
+resource "aws_ses_domain_identity" "cognoma" {
+  domain = "${var.cognoma-domain}"
+}
+
 resource "aws_route53_record" "cognoma-api" {
   zone_id = "${data.aws_route53_zone.cognoma.zone_id}"
-  name    = "api.cognoma.org"
-  type    = "A"
+  name = "api.${var.cognoma-domain}"
+  type = "A"
 
   alias {
     name = "${aws_elb.cognoma-nginx.dns_name}"
     zone_id = "${aws_elb.cognoma-nginx.zone_id}"
     evaluate_target_health = false
   }
 }
+
+resource "aws_route53_record" "cognoma-ses-verification-record" {
+  zone_id = "${data.aws_route53_zone.cognoma.zone_id}"
+  name = "${var.cognoma-domain}"
+  type = "TXT"
+  ttl = "5"
+  records = ["${aws_ses_domain_identity.cognoma.verification_token}"]
+}