SESRuleToSlack-Template.yaml

# MIT License

# Copyright (c) 2022 Chris Farris (https://www.chrisfarris.com)

# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:

# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.

# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# Note - You must have already setup a verified identity for the domain and configured the MX Records as described here:
# https://docs.aws.amazon.com/ses/latest/dg/receiving-email-setting-up.html
# You must also create the S3 Bucket specified by pDeliveryBucketName parameter

AWSTemplateFormatVersion: '2010-09-09'
Description: Create an inbound SES Rule to push all email from a specific domain to a slack channel

Parameters:

  pSlackWebhookSecret:
    Description: Name of the Secrets Manager secret where the WebHook is stored
    Type: String

  pIconEmoji:
    Description: Slack Emoji to use
    Type: String
    Default: ':email:'

  pRuleSetName:
    Type: String
    Description: Name of the RuleSet for this account

  pCreateRuleSet:
    Description: Create a RuleSet, or using an existing one. An account can only have one active RuleSet at a time
    Type: String
    AllowedValues:
    - "yes"
    - "no"

  pCreateBucket:
    Description: Create a new Bucket, or reuse and existing one
    Type: String
    AllowedValues:
    - "yes"
    - "no"

  pDomain:
    Type: String
    Description: Domain Name that is SES should recieve email for.

  pDeliveryBucketName:
    Type: String
    Description: Pre-existing S3 Bucket to Send the raw emails to.

Conditions:
  cCreateRuleSet: !Equals [ !Ref pCreateRuleSet, "yes"]
  cCreateBucket: !Equals [ !Ref pCreateBucket, "yes"]


Resources:

  MessageS3Bucket:
    DeletionPolicy: Retain
    Condition: cCreateBucket
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref pDeliveryBucketName
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE

  BillingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: cCreateBucket
    Properties:
      Bucket: !Ref MessageS3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: AllowSESPuts
          Effect: Allow
          Principal:
            Service: ses.amazonaws.com
          Action: s3:PutObject
          Resource: !Sub "arn:aws:s3:::${pDeliveryBucketName}/*"
          Condition:
            StringEquals:
              AWS:SourceAccount: !Ref AWS::AccountId
            StringLike:
              AWS:SourceArn: arn:aws:ses:*

  SESReceiptRuleSet:
    Type: AWS::SES::ReceiptRuleSet
    Condition: cCreateRuleSet
    Properties:
      RuleSetName: !Ref pRuleSetName

  SESReceiptRule:
    Type: 'AWS::SES::ReceiptRule'
    DependsOn:
      - SlackNotificationLambdaPermission
    Properties:
      RuleSetName: !Ref pRuleSetName
      Rule:
        Name: !Ref pDomain
        Enabled: true
        ScanEnabled: true
        Recipients:
          - !Ref pDomain
          - !Sub ".${pDomain}"
        Actions:
          - LambdaAction:
              FunctionArn: !GetAtt EmailToSlackLambda.Arn
          - S3Action:
              BucketName: !Ref pDeliveryBucketName
              ObjectKeyPrefix: !Sub "${pDomain}/"

  EmailToSlackLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: [ lambda.amazonaws.com ]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: CloudWatch
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - 'cloudwatch:*'
            Effect: Allow
            Resource: '*'
      - PolicyName: logs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Resource: '*'
            Action:
            - 'logs:*'
            Effect: Allow
      - PolicyName: SecretAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: secretsmanager:GetSecretValue
            Resource: !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${pSlackWebhookSecret}*"
      - PolicyName: "FetchMessagesFromS3"
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: s3:GetObject
            Resource:
              - !Sub "arn:aws:s3:::${pDeliveryBucketName}/${pDomain}/*"

  EmailToSlackLambda:
    Type: AWS::Lambda::Function
    Properties:
      Description: Send SNS AlertTopics to Slack Channel
      Runtime: python3.7
      Handler: index.lambda_handler
      Timeout: '80'
      FunctionName: !Sub "${AWS::StackName}"
      Role: !GetAtt EmailToSlackLambdaRole.Arn
      Environment:
        Variables:
          LOG_LEVEL: INFO
          WEBHOOK: !Ref pSlackWebhookSecret
          ICON_EMOJI: !Ref pIconEmoji
          BUCKET: !Ref pDeliveryBucketName
          DOMAIN: !Ref pDomain
      Code:
        ZipFile: |
          # Lambda to send SES Emails Messages to Slack

          from base64 import b64decode
          from botocore.exceptions import ClientError
          import boto3
          import email
          import json
          import os
          import urllib3

          import logging
          logger = logging.getLogger()
          logger.setLevel(getattr(logging, os.getenv('LOG_LEVEL', default='INFO')))
          logging.getLogger('botocore').setLevel(logging.WARNING)
          logging.getLogger('boto3').setLevel(logging.WARNING)
          logging.getLogger('urllib3').setLevel(logging.WARNING)


          def get_webhook(secret_name):
            client = boto3.client('secretsmanager')
            try:
              get_secret_value_response = client.get_secret_value(SecretId=secret_name)
            except ClientError as e:
              logger.critical(f"Unable to get secret value for {secret_name}: {e}")
              return(None)
            else:
              if 'SecretString' in get_secret_value_response:
                secret_value = get_secret_value_response['SecretString']
              else:
                secret_value = get_secret_value_response['SecretBinary']
            try:
              secret_dict = json.loads(secret_value)
              return(secret_dict['webhook_url'])
            except Exception as e:
              logger.critical(f"Error during Credential and Service extraction: {e}")
              raise

          WEBHOOK=get_webhook(os.environ['WEBHOOK'])
          http = urllib3.PoolManager()

          def lambda_handler(event, context):
            logger.info("Received event: " + json.dumps(event, sort_keys=True))
            for record in event['Records']:
              process_message(record['ses'])
          # end handler


          def process_message(message):
            logger.debug("processing message: " + json.dumps(message, sort_keys=True))
            message_id = message['mail']['messageId']

            raw_message = fetch_from_s3(message_id)
            if raw_message is None:
              message_body = "Unable to get Message"
            else:
              message_body = parse_email_file(raw_message).decode('utf-8')

            logger.debug(f"Found Message body: {message_body}")

            slack_message = {
              'icon_emoji': os.environ['ICON_EMOJI'],
              'attachments': [
                {
                  'footer': message_id,
                  'pretext': f"New Email for {os.environ['DOMAIN']}",
                  'color': "red",
                  'title': f"Subject: {message['mail']['commonHeaders']['subject']}",
                  'fields': [
                          {"title": "From:","value": message['mail']['commonHeaders']['from'][0], "short": True},
                          {"title": "To:","value": str(message['mail']['commonHeaders']['to']), "short": True},
                          {"title": "Date:","value": message['mail']['commonHeaders']['date'], "short": True},
                          {"title": "Body:","value": message_body,"short": False},
                  ],
                  # "text": "Message body goes here",
                  'mrkdwn_in': ["title"],
                }
              ]
            }
            try:
              r = http.request('POST', WEBHOOK, body=json.dumps(slack_message))
              logger.info(f"Message posted")
            except Exception as e:
              logger.error(f"Request failed: {e}")
          # End process_message()


          def parse_email_file(raw_message):
            b = email.message_from_string(raw_message)
            body = ""

            if b.is_multipart():
              for part in b.walk():
                ctype = part.get_content_type()
                cdispo = str(part.get('Content-Disposition'))

                # skip any text/plain (txt) attachments
                if ctype == 'text/plain' and 'attachment' not in cdispo:
                  body = part.get_payload(decode=True)  # decode
                  break
            # not multipart - i.e. plain text, no attachments, keeping fingers crossed
            else:
              body = b.get_payload(decode=True)
            return(body)


          def fetch_from_s3(message_id):
            s3_client = boto3.client('s3')
            try:
              object_key = f"{os.environ['DOMAIN']}/{message_id}"
              response = s3_client.get_object(Bucket=os.environ['BUCKET'], Key=object_key)
              return (response['Body'].read().decode('utf-8'))
            except Exception as e:
              logger.error(f"Unable to get Object s3://{os.environ['BUCKET']}/{object_key}: {e}")
              return(None)

          # End of Function

  SlackNotificationLambdaInvocationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
              - ses.amazonaws.com
          Action:
              - sts:AssumeRole
      Path: /
      Policies:
      - PolicyName: ExecuteSlackLambda
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action:
            - lambda:InvokeFunction
            Effect: Allow
            Resource:
            - !GetAtt EmailToSlackLambda.Arn

  SlackNotificationLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt EmailToSlackLambda.Arn
      Principal: ses.amazonaws.com
      SourceArn: !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:receipt-rule-set/${pRuleSetName}:receipt-rule/${pDomain}"
      Action: lambda:invokeFunction

Outputs:

  TemplateVersion:
    Value: "1.0.0"