AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Create IAM group, policy, and user to be used for sending email via SES.
Parameters:
  SesUserName:
    Default: myapp-ses-smtp-user
    Description: Name for the newly created IAM user
    Type: String
  SesUserPath:
    Default: /holding-id/ses/
    Description: Path for the newly created IAM user
    Type: String
  SesGroupName:
    Default: ses-email-senders
    Description: Name for the IAM group to allow sending email via SES
    Type: String
  SesPolicyName:
    Default: ses-send-email
    Description: Name for the IAM managed policy to allow sending email via SES
    Type: String
Resources:
  SesPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Description: Allows sending email via SES.
      ManagedPolicyName: ses-send-email
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Action:
              - ses:SendBounce
              - ses:SendEmail
              - ses:SendRawEmail
            Resource: '*'

  SesGroup:
    Type: "AWS::IAM::Group"
    Properties:
      GroupName: !Ref SesGroupName
      ManagedPolicyArns:
        - !Ref SesPolicy

  SesUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref SesUserName
      Path: !Ref SesUserPath
      Groups:
        - !Ref SesGroup

  SesUserCredentials:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName:
        !Ref SesUser

Outputs:
  SesUserAccessKey:
    Description: Access key for the new SesUser
    Value:
      !Ref SesUserCredentials
  SesUserSecretAccessKey:
    Description: Secret access key for the new SesUser
    Value: !GetAtt SesUserCredentials.SecretAccessKey
