forwarder.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Cloudformation to forward SES email to another address'
Parameters:
  FromAddress:
    Description: Email forwarded from address
    Type: String
  ToAddress:
    Description: Email forwarded to address
    Type: String
  Recipient:
    Description: Recipient domains and email addresses that the receipt rule applies to
    Type: String
Resources:
  SESEmailForwardFunction:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Role: !GetAtt SESEmailForwardRole.Arn
      Timeout: 30
      Environment:
        Variables:
          from_address: { "Fn::Sub": [ "${FromAddress}", { "FromAddress": {"Ref" : "FromAddress" }} ]}
          to_address: { "Fn::Sub": [ "${ToAddress}", { "ToAddress": {"Ref" : "ToAddress" }} ]}
      Code:
        ZipFile: !Sub |
          var AWS = require('aws-sdk');
          var forwardFrom = process.env.from_address;
          var forwardTo = process.env.to_address;
          exports.handler = function(event, context) {
              var msgInfo = JSON.parse(event.Records[0].Sns.Message);

              // don't process spam messages
              if (msgInfo.receipt.spamVerdict.status === 'FAIL' || msgInfo.receipt.virusVerdict.status === 'FAIL') {
                  console.log('Message is spam or contains virus, ignoring.');
                  context.succeed();
              }
          
              console.log('Msg');
              console.log(msgInfo);


              var email = msgInfo.content, headers = "From: "+forwardFrom+"\r\n";
              headers += "Reply-To: "+msgInfo.mail.commonHeaders.from[0]+"\r\n";
              headers += "X-Original-To: "+msgInfo.mail.commonHeaders.to[0]+"\r\n";
              headers += "To: "+forwardTo+"\r\n";
              headers += "Subject: Fwd: "+msgInfo.mail.commonHeaders.subject+"\r\n";

              if (email) {
                  var res;
                  res = email.match(/Content-Type:.+\s*boundary.*/);
                  if (res) {
                      headers += res[0]+"\r\n";
                  }
                  else {
                      res = email.match(/^Content-Type:(.*)/m);
                      if (res) {
                          headers += res[0]+"\r\n";
                      }
                  }

                  res = email.match(/^Content-Transfer-Encoding:(.*)/m);
                  if (res) {
                      headers += res[0]+"\r\n";
                  }

                  res = email.match(/^MIME-Version:(.*)/m);
                  if (res) {
                      headers += res[0]+"\r\n";
                  }

                  var splitEmail = email.split("\r\n\r\n");
                  splitEmail.shift();

                  email = headers+"\r\n"+splitEmail.join("\r\n\r\n");
              }
              else {
                  email = headers+"\r\n"+"Empty email";
              }

              new AWS.SES().sendRawEmail({
                  RawMessage: { Data: email }
              }, function(err, data) {
                  if (err) context.fail(err);
                  else {
                      console.log('Sent with MessageId: ' + data.MessageId);
                      context.succeed();
                  }
              });
          }
      Runtime: nodejs12.x
  SNSEmailReceiveTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
      - Endpoint:
          !GetAtt SESEmailForwardFunction.Arn
        Protocol: lambda
  SESEmailForwardRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: SESEmailForward
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - ses:SendEmail
            - ses:SendRawEmail
            Resource: "*"
  SNSLambdaInvokeRole:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn:
        Ref: SNSEmailReceiveTopic
      FunctionName:
        !GetAtt SESEmailForwardFunction.Arn
  SESEmailForwardRuleSet:
    Type: AWS::SES::ReceiptRuleSet
  SESEmailForwardRule:
    Type: AWS::SES::ReceiptRule
    Properties:
      RuleSetName: !Ref SESEmailForwardRuleSet
      Rule:
        Enabled: true
        ScanEnabled: true
        Recipients:
          - Ref: Recipient
        Actions:
          - SNSAction:
              Encoding: UTF-8
              TopicArn: !Ref SNSEmailReceiveTopic

Outputs:
  LambdaFunction:
    Value: { Ref : SESEmailForwardFunction }