如何为AWS Cognito用户池设置电子邮件配置？

Question

我不确定如何设置无服务器云形成资源部分的“EmailConfiguration”部分。有没有人有如何做到这一点的示例？任何指导都将不胜感激！

以下是我的 serverless.yml 文件。

service: cognito-email-config
provider:
  name: aws
  runtime: nodejs6.10
  region: us-east-1

plugins:
  - serverless-stack-output

custom:
  output:
    handler: serverless/output.handler
    file: outputs/stack.json

functions:
  preSignUp:
    handler: serverless/preSignUp.handler
  postConfirmation:
    handler: serverless/postConfirmation.handler

resources:
  Resources:
    SESRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "cognito-idp.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        Policies:
          - PolicyName: "CognitoSESPolicy"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - "ses:SendEmail"
                    - "ses:SendRawEmail"
                  Resource: "*"
    CognitoUserPool:
      Type: "AWS::Cognito::UserPool"
      Properties:
        UserPoolName: ${env:COGNITO_USER_POOL}
        EmailConfiguration:
          ReplyToEmailAddress: [e-mail]
          SourceArn:
            Fn::GetAtt: [SESRole, Arn]
        AutoVerifiedAttributes:
          - phone_number
        MfaConfiguration: "OPTIONAL"
        SmsConfiguration:
          ExternalId: ${env:COGNITO_USER_POOL}-external
          SnsCallerArn:
            Fn::GetAtt: [SNSRole, Arn]
        Schema:
          - Name: name
            AttributeDataType: String
            Mutable: true
            Required: true
          - Name: email
            AttributeDataType: String
            Mutable: false
            Required: true
          - Name: phone_number
            AttributeDataType: String
            Mutable: false
            Required: true

运行后我得到了以下错误...

Serverless: Deployment failed!

  Serverless Error ---------------------------------------

  An error occurred while provisioning your stack: CognitoUserPool - Email arn does not belong to your account. (Service: AWSCognitoIdentityProvider; Status Code: 400; Error Code: NotAuthorizedException; Request ID: f2b14a38-82a1-11e7-8ea0-eb271a42c298).

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Forums:        forum.serverless.com
     Chat:          gitter.im/serverless/serverless

  Your Environment Information -----------------------------
     OS:                     linux
     Node Version:           8.2.1
     Serverless Version:     1.20.0

ERROR: Job failed: exit code 1

我认为我没有正确使用"EmailConfiguration"的"SourceArn"; 我只是从SNS复制了下面的代码示例到SES中，并希望它能正常工作。

这里是我需要设置的AWS文档参考资源： http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html#cfn-cognito-userpool-emailconfiguration

这个文档对我有所帮助，但没有展示如何使用SES： https://gist.github.com/singledigit/2c4d7232fa96d9e98a3de89cf6ebe7a5

- Travis

Answer 1

我经历了同样的困扰，最终弄清楚了。AWS 在这方面的文档非常糟糕。分享我的经验，希望能帮助你和其他人。

1.) 您需要在 SES 中验证要发送邮件的电子邮件地址。

2.) 验证电子邮件后，您可以在 SES 仪表板中单击该电子邮件并查看其标识 ARN（例如，arn:aws:ses:us-west-2:MY-AWS-ACCOUNT-NUMBER:identity/[e-mail]）。此标识 ARN 是您将在上面的 CloudFormation 中用作 EmailConfiguration 下的 SourceARN 的内容。

3.) 一旦您在 SES 仪表板中单击已验证的电子邮件，您就有设置 Identity Policies 的选项。在那里添加此代码片段（将下面的 Resource ARN 替换为您从步骤 2 获取的正确标识 ARN）：

{
    "Version": "2008-10-17",
    "Statement": [
        {
             "Sid": "stmnt1234567891234",
             "Effect": "Allow",
             "Principal": {
                "Service": "cognito-idp.amazonaws.com"
             },
             "Action": [
                 "ses:SendEmail",
                 "ses:SendRawEmail"
             ],
             "Resource": "arn:aws:ses:us-west-2:<MY-AWS-ACCOUNT-NUMBER>:identity/[e-mail]"
         }
     ]
 }

- Justin