feat(ses): add SES module with context-based naming and NHS tagging s… - #109
Open
Pira-nhs wants to merge 4 commits into
Open
feat(ses): add SES module with context-based naming and NHS tagging s…#109Pira-nhs wants to merge 4 commits into
Pira-nhs wants to merge 4 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new Terraform wrapper module under infrastructure/modules/ses to provision an AWS SES domain identity using the repository’s standard context.tf tagging/context pattern, plus documentation and automation updates so the module is discoverable and tracked by Dependabot.
Changes:
- Introduces a new
sesmodule wrappingcloudposse/ses/awswith domain/DKIM/SPF/Mail-From options and cross-variable preconditions (validations.tf). - Adds module documentation (
infrastructure/modules/ses/README.md) and provider lockfile for the module. - Updates the root module list (
README.md) and Dependabot module directory list (.github/dependabot.yaml).
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds ses to the repository “Available modules” table. |
| .github/dependabot.yaml | Adds the new SES module directory to Dependabot’s Terraform scanning list. |
| infrastructure/modules/ses/main.tf | Wraps cloudposse/ses/aws and wires in module.this.enabled + module.this.tags. |
| infrastructure/modules/ses/variables.tf | Declares SES-specific inputs (domain, Route53/DKIM/SPF toggles, MAIL FROM options). |
| infrastructure/modules/ses/validations.tf | Adds plan-time cross-variable constraints via terraform_data preconditions. |
| infrastructure/modules/ses/outputs.tf | Exposes key outputs (identity ARN, verification token, DKIM tokens, SPF record, custom MAIL FROM domain). |
| infrastructure/modules/ses/versions.tf | Defines Terraform/provider version constraints (aws + awsutils). |
| infrastructure/modules/ses/context.tf | Provides the standard repository context/tagging interface via the shared tags module. |
| infrastructure/modules/ses/README.md | Documents fixed controls, provider requirements, usage examples, and generated terraform-docs section. |
| infrastructure/modules/ses/.terraform.lock.hcl | Locks provider versions/hashes for the module. |
Files not reviewed (1)
- infrastructure/modules/ses/.terraform.lock.hcl: Generated file
Suppressed comments (1)
infrastructure/modules/ses/README.md:199
- The terraform-docs section disables Vale/markdownlint but never re-enables them. Other module READMEs add
<!-- markdownlint-restore -->and<!-- vale on -->after<!-- END_TF_DOCS -->(e.g. infrastructure/modules/s3-bucket/README.md), and missing them can hide linting problems later in the file.
<!-- END_TF_DOCS -->
Comment on lines
+13
to
+18
| # Inputs intentionally NOT exposed (hardcoded below): | ||
| # - iam_create_access_key → always false; credentials must not be stored in state | ||
| # - iam_create_ses_smtp_password → always false; credentials must not be stored in state | ||
| # - ses_user_enabled → always false; use ECS task IAM roles for sending | ||
| # - ses_group_enabled → always false; use ECS task IAM roles for sending | ||
| # - custom_from_behavior_on_mx_failure → UseDefaultValue (sensible default, not exposed) |
Comment on lines
+7
to
+12
| # Inputs NOT exposed here (opinionated defaults hardcoded in main.tf): | ||
| # - iam_create_access_key → always false (credentials must not be stored in state) | ||
| # - iam_create_ses_smtp_password → always false (credentials must not be stored in state) | ||
| # - ses_user_enabled → always false (ECS tasks use IAM roles, not IAM users) | ||
| # - ses_group_enabled → always false (ECS tasks use IAM roles, not IAM users) | ||
| # - custom_from_behavior_on_mx_failure → UseDefaultValue (sensible default, not exposed) |
Contributor
|
The terraform-docs section disables Vale/markdownlint but never re-enables them. Other module READMEs add and after (e.g. infrastructure/modules/s3-bucket/README.md), and missing them can hide linting problems later in the file. |
nhs-oliverslater
previously approved these changes
Jul 31, 2026
…nhance documentation
Pira-nhs
force-pushed
the
feature/BCSS-23795-create-ses-module
branch
from
July 31, 2026 16:11
3689a35 to
56d76c8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…tandards
Description
Context
Type of changes
Checklist
Sensitive Information Declaration
To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.