feat(cognito): user pool: send emails using Amazon SES #17117

corymhall · 2021-10-22T13:02:48Z

add support for SES integration by introducing a new property for
configuring email settings for a user pool. This feature supports both
types of integration with SES.

Using the COGNITO_DEFAULT sending account, but providing a custom
email address
Using the DEVELOPER sending account

This feature does not automate any configuration on SES since that is
not currently possible with CloudFormation and requires a manual
verification step. To use the SES integration introduced in this feature
the user will have had to already configured a verified email address in
Amazon SES and followed the steps outlined here:
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html

closes #6768

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

add support for SES integration by introducing a new property for configuring email settings for a user pool. This feature supports both types of integration with SES. 1. Using the COGNITO_DEFAULT sending account, but providing a custom email address 2. Using the DEVELOPER sending account This feature does not automate any configuration on SES since that is not currently possible with CloudFormation and requires a manual verification step. To use the SES integration introduced in this feature the user will have had to already configured a verified email address in Amazon SES and followed the steps outlined here: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html closes #6768

gitpod-io · 2021-10-22T13:02:51Z

mnanchev

Looks good, maybe just Beta1 is avoidable

nija-at

Initial comments just based on the README.

packages/@aws-cdk/aws-cognito/README.md

nija-at · 2021-10-27T14:34:13Z

packages/@aws-cdk/aws-cognito/README.md

+this email must be a verified email address in Amazon SES, and that email address must have an authorization policy
+that allows Cognito to send emails. See the section `Step 3: Grant Email Permissions to Amazon Cognito` of the


must have an authorization policy that allows Cognito to send emails

can we auto-configure this policy as part of the cognito module? What would that take?

We would need to configure this policy by using a custom resource that calls put-identity-policy. A prerequisite would be creating the email in SES, but it wouldn't need to be verified or fully configured to attach this policy.

I wasn't sure about configuring this one piece in SES since it feels like SES should have it's own package that controls it's configuration. I think ideally the user experience would look like this, although I don't know if SES will get CloudFormation resources anytime soon.

const sesIdentity = new ses.Identity(this, 'Identity', { email: 'user@example.com', }); sesIdentity.addAuthorization(new authorizations.CognitoAuthorization(userpool));

Email verification is clearly an out-of-band process, and we cannot automate that in the cdk.

Calling put-identity-policy via a custom resource is something we can do, i.e., add it to the aws-ses module and use it from here.
If you're interested, you could consider something like this in a subsequent PR. I'm ok with shipping it without this feature available yet.

packages/@aws-cdk/aws-cognito/README.md

packages/@aws-cdk/aws-cognito/lib/user-pool.ts

packages/@aws-cdk/aws-cognito/README.md

(before the '@') must only include ASCII characters, but the domain can be punycode encoded.

nija-at

Spent some time on this PR. Not complete yet.

packages/@aws-cdk/aws-cognito/README.md

nija-at · 2021-10-29T09:34:16Z

packages/@aws-cdk/aws-cognito/README.md

+```ts
+new cognito.UserPool(this, 'myuserpool', {
+  email: Email.withSES({
+    sesRegion: SESRegion.US_EAST_1,


We don't need an enum for this. Region is just a string in the cdk. We can just add a validation for the list of valid regions.

Still show as an enum. README needs to be updated.

ah sorry, should be fixed now.

nija-at · 2021-10-29T09:39:35Z

packages/@aws-cdk/aws-cognito/lib/user-pool.ts

+   * Required if the UserPool region is different than the SES region.
+   *
+   * If sending emails with a Amazon SES verified email address,
+   * and the region that SES is configured is different than the
+   * region in which the UserPool is deployed, you must specify that
+   * region here.
+   *
+   * @default - The same region as the Cognito UserPool
+   */
+  readonly sesRegion?: SESRegion;


What happens if this property is not specified and the region is not the expected SES region?

then it will throw an error telling the user to provide this property.

"it" here being CloudFormation deployment?

I have validation logic to validate that a correct region is is provided and the library will throw an error if it is not a valid region.

https://github.com/aws/aws-cdk/pull/17117/files#diff-46f225425155cdae9873139ac778b85e5312e63ed690512df01a449a9f45c1a6R195

packages/@aws-cdk/aws-cognito/lib/user-pool.ts

removing regions property in favor of a const switching sesRegions to take a string deprecating emailSettings property other small doc updates

nija-at

Looks much better. See more comments below.

nija-at · 2021-11-05T14:22:35Z

packages/@aws-cdk/aws-cognito/README.md

+```ts
+new cognito.UserPool(this, 'myuserpool', {
+  email: Email.withSES({
+    sesRegion: SESRegion.US_EAST_1,


Still show as an enum. README needs to be updated.

nija-at · 2021-11-05T14:24:01Z

packages/@aws-cdk/aws-cognito/lib/user-pool-email.ts

+/**
+ * Configuration for Cognito sending emails via Amazon SES
+ */
+export interface SESOptions {


Since this module contains both user pool and identity pool, perhaps rename this as UserPoolSESOptions.

Same for other names as well.

Updated all the exported names.

packages/@aws-cdk/aws-cognito/lib/user-pool-email.ts

nija-at · 2021-11-05T14:38:57Z

packages/@aws-cdk/aws-cognito/lib/user-pool-email.ts

+    // if a custom email is provided that means that cognito is going to use an SES email
+    // and we need to provide the sourceArn which requires a valid region


I'm confused. Cognito email is not SES email right? Are we mixing these up?

It is a little confusing, maybe I can add some more explanation to the README. There are technically two modes to Cognito default email.

Using the default no-reply@verificationemail.com
In this case Cognito is handling sending the email because it is using an email address owned by AWS.

Using a custom email address.
In this case even though it is still using the Cognito default email functionality, it is actually using SES to send the email, so it does require you to have the email configured in SES.

Can we then roll #2 into Email.withSES() instead? That would keep this simpler/ easier to explain.

hmm that is a good point. I can't think of a reason why you would want to use Cognito default through SES instead of just SES directly. I'll update.

OK, I updated withCognito to only take the replyTo email address. You now how two options

Cognito default with the default no-reply@verificationemail.com email and optionally a replyTo email address.

Sending emails through SES.

I completely removed option 2 from my previous response since you don't gain anything over just configuring Cognito to use SES.

packages/@aws-cdk/aws-cognito/README.md

packages/@aws-cdk/aws-cognito/lib/user-pool-email.ts

nija-at · 2021-11-15T15:36:33Z

packages/@aws-cdk/aws-cognito/lib/user-pool-email.ts

+   * Returns the email configuration for a Cognito UserPool
+   * that controls how Cognito will send emails
+   */
+  public abstract bind(scope: Construct): UserPoolEmailConfig;


I like to use UserPoolEmailBindOptions as the parameter to bind().
This allows for more properties to be added, deprecated, etc. here without breaking changes.

The other option is to mark this API as @internal and not export UserPoolEmailConfig. Then changes to this API will not be considered breaking.
This option assumes that there aren't going to be many other ways in which customers will want to bind their own implementations here. Seems ok in this case since I don't expect Cognito to support other options than SES.

Updated to be @internal

mergify · 2021-11-15T18:33:21Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2021-11-15T20:52:55Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
Commit ID: da4352d
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2021-11-15T20:53:48Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

add support for SES integration by introducing a new property for configuring email settings for a user pool. This feature supports both types of integration with SES. 1. Using the COGNITO_DEFAULT sending account, but providing a custom email address 2. Using the DEVELOPER sending account This feature does not automate any configuration on SES since that is not currently possible with CloudFormation and requires a manual verification step. To use the SES integration introduced in this feature the user will have had to already configured a verified email address in Amazon SES and followed the steps outlined here: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html closes aws#6768 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

corymhall added 2 commits October 22, 2021 12:42

fixing from when no name is provided

57bc195

github-actions bot added the @aws-cdk/aws-cognito Related to Amazon Cognito label Oct 22, 2021

github-actions bot assigned nija-at Oct 22, 2021

mnanchev suggested changes Oct 24, 2021

View reviewed changes

mergify bot added the contribution/core This is a PR that came from AWS. label Oct 27, 2021

nija-at changed the title ~~feat(aws-cognito): add support for user pool SES integration~~ feat(cognito): add support for user pool SES integration Oct 27, 2021

nija-at changed the title ~~feat(cognito): add support for user pool SES integration~~ feat(cognito): support for user pool SES integration Oct 27, 2021

corymhall requested review from nija-at and a team October 27, 2021 14:27

nija-at suggested changes Oct 27, 2021

View reviewed changes

corymhall added 2 commits October 27, 2021 17:31

updates based on review

08409b8

add validation on email addresses. The local part of the email address

5a0daae

(before the '@') must only include ASCII characters, but the domain can be punycode encoded.

nija-at suggested changes Oct 29, 2021

View reviewed changes

moving email settings to separate file

641d8ab

removing regions property in favor of a const switching sesRegions to take a string deprecating emailSettings property other small doc updates

corymhall requested review from nija-at and a team November 1, 2021 17:43

nija-at suggested changes Nov 5, 2021

View reviewed changes

corymhall added 2 commits November 5, 2021 18:09

updates based on review comments

d59fc24

fixing typo

cc6871d

corymhall requested a review from nija-at November 5, 2021 18:20

nija-at changed the title ~~feat(cognito): support for user pool SES integration~~ feat(cognito): user pool: send emails using Amazon SES Nov 15, 2021

nija-at added the pr/do-not-merge This PR should not be merged at this time. label Nov 15, 2021

nija-at approved these changes Nov 15, 2021

View reviewed changes

corymhall added 2 commits November 15, 2021 17:16

updates based on review

bd209b5

Merge branch 'master' into userpool-ses

70807f7

corymhall removed the pr/do-not-merge This PR should not be merged at this time. label Nov 15, 2021

Merge branch 'master' into userpool-ses

da4352d

mergify bot merged commit 503720f into aws:master Nov 15, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cognito): user pool: send emails using Amazon SES #17117

feat(cognito): user pool: send emails using Amazon SES #17117

corymhall commented Oct 22, 2021

gitpod-io bot commented Oct 22, 2021

mnanchev left a comment

nija-at left a comment

nija-at Oct 27, 2021

corymhall Oct 27, 2021

nija-at Oct 29, 2021

nija-at left a comment

nija-at Oct 29, 2021

corymhall Oct 29, 2021

nija-at Nov 5, 2021

corymhall Nov 5, 2021

nija-at Oct 29, 2021

corymhall Oct 29, 2021

nija-at Oct 29, 2021

corymhall Oct 29, 2021

nija-at left a comment

nija-at Nov 5, 2021

nija-at Nov 5, 2021

corymhall Nov 5, 2021

nija-at Nov 5, 2021

corymhall Nov 5, 2021

nija-at Nov 5, 2021 •

edited

corymhall Nov 5, 2021

corymhall Nov 5, 2021

nija-at Nov 15, 2021

corymhall Nov 15, 2021

mergify bot commented Nov 15, 2021

aws-cdk-automation commented Nov 15, 2021

mergify bot commented Nov 15, 2021

		this email must be a verified email address in Amazon SES, and that email address must have an authorization policy
		that allows Cognito to send emails. See the section `Step 3: Grant Email Permissions to Amazon Cognito` of the

		// if a custom email is provided that means that cognito is going to use an SES email
		// and we need to provide the sourceArn which requires a valid region

feat(cognito): user pool: send emails using Amazon SES #17117

feat(cognito): user pool: send emails using Amazon SES #17117

Conversation

corymhall commented Oct 22, 2021

gitpod-io bot commented Oct 22, 2021

mnanchev left a comment

Choose a reason for hiding this comment

nija-at left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nija-at left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nija-at left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nija-at Nov 5, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mergify bot commented Nov 15, 2021

aws-cdk-automation commented Nov 15, 2021

AWS CodeBuild CI Report

mergify bot commented Nov 15, 2021

nija-at Nov 5, 2021 •

edited