feat: Add support for custom Lambda function email senders in Auth construct #2087

vigy02 · 2024-10-07T21:08:40Z

Problem

This PR addresses the need for more flexible email sender configuration in the Auth construct, specifically allowing the use of custom Lambda functions for email sending capabilities.

Changes

Added support for using Lambda functions as email senders in the Auth construct
Implemented KMS key management for custom email senders
Updated types and interfaces to accommodate new email sender options
Added new test case for custom email sender functionality
Modified existing code to handle Lambda function email senders, including permission setup
Introduced functionality for attaching a user's KMS key to the customEmailSender for message encryption and decryption.
Added integration tests to verify customEmailSender functionality.

Validation

A new test case was added to verify the behavior when a function is provided as an email sender. This test ensures that the custom email sender is properly set up when a Lambda function is provided.

** Manual Validation for KMS-ARN pass check **

Checklist

If this PR includes a functional change to the runtime behavior of the code, I have added or updated automated test coverage for this change.

sobolk · 2024-10-25T13:15:18Z

.eslint_dictionary.json

+  "zoneinfo",
+  "SKey",
+  "decrypt"


please insert those in alphabetical order.

sobolk · 2024-10-25T13:17:03Z

packages/ai-constructs/API.md

@@ -54,6 +54,7 @@ type ConversationHandlerFunctionProps = {
        modelId: string;
        region?: string;
    }>;
+    memoryMB?: number;


you might need to merge latest main. this change shouldn't be on the diff.

sobolk · 2024-10-25T13:21:45Z

packages/auth-construct/API.md

+        email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | IFunction;
+        kmsKeyArn?: string;


Is kmsKeyArn applicable to any of Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> ?

If not then we should introduce type for custom sender.
Something like:
type CustomEmailSender = { handler: IFunction, kmsKeyArn?: string } and then use that instead of IFunction in the union.

Or perhaps have email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | IFunction | CustomEmailSender so that passing function without kmskey is still easy.

The bottom line is that we should find typing that doesn't let you specify kmsKeyArn if IFunction is not used.

@josefaidt wdyt ?

this is a good point, i think this would be enough:
email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | CustomEmailSender

feedback makes sense. I like this take

email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | IFunction | CustomEmailSender

this is also simple, and easier to understand that you only have two valid configuration options (ses or a sender function with/without a custom kms key)

email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | CustomEmailSender

sobolk · 2024-10-25T13:23:12Z

packages/backend-auth/API.md

+        email: Pick<UserPoolSESOptions, 'fromEmail' | 'fromName' | 'replyTo'> | ConstructFactory<AmplifyFunction>;
+        kmsKeyArn?: string;


Similar feedback here. We should find better typing.

sobolk · 2024-10-25T13:31:36Z

packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

+      (name) => name.includes('say-hello')
+    ); // TODO - add func name


yes, we should name this function something different.

sobolk · 2024-10-25T13:38:52Z

packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

@@ -280,6 +287,7 @@ class DataStorageAuthWithTriggerTestProject extends TestProjectBase {
    await this.checkLambdaResponse(node16Lambda[0], expectedResponse);
    await this.checkLambdaResponse(funcWithSsm[0], 'It is working');
    await this.checkLambdaResponse(funcWithAwsSdk[0], 'It is working');
+    await this.checkLambdaResponse(funcCustomSender[0], 'Hello, World!');


This is not good assertion for this feature. It just sends request directly to lambda. We should be asserting that communication between cognito and lambda works.

How to make this happen?:

We need to execute an operation on user pool that triggers email sending.

We need a function that can signal a fact that it was called by something and await that.

Please take a look at solution we have for "scheduled functions". We use SQS queue to capture the fact that function was called.

amplify-backend/packages/integration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/func-src/handler_with_aws_sqs.ts

Lines 20 to 25 in 10ef35d

await sqsClient.send(

new SendMessageCommand({

QueueUrl: queueUrl,

MessageBody: messageBody,

})

);

amplify-backend/packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

Line 614 in 10ef35d

// wait for schedule to invoke the function one time for it to send a message

And fail with timeout (if sqs message doesn't arrive),

…nt dict

sobolk · 2024-10-31T17:26:30Z

packages/auth-construct/API.md

@@ -84,6 +85,12 @@ export type CustomAttributeString = CustomAttributeBase & StringAttributeConstra
    dataType: 'String';
 };

+// @public
+export type CustomEmailSenderConstruct = {


Suggested change

export type CustomEmailSenderConstruct = {

export type CustomEmailSender = {

or CustomEmailSenderOptions

This is not a construct. It has a reference to IFunction inside but this type is not implementing Construct super class.

sobolk · 2024-10-31T17:31:47Z

packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

+    const queue = await this.resourceFinder.findByBackendIdentifier(
+      backendId,
+      'AWS::SQS::Queue',
+      (name) => name.includes('testFuncQueue')
+    );


We should add separate queue for this scenario.

Otherwise messages from email and scheduled functions will land in the same queue and we can't tell which one is which.

It seems that sequencing of post deployment assertions help. But it's very implicit assumption. Using separate resources for both scenarios will remove that trap.

sobolk · 2024-10-31T17:32:26Z

packages/integration-tests/src/test-project-setup/data_storage_auth_with_triggers.ts

+        UserPoolId: userPoolId[0],
+        Username: username,
+        TemporaryPassword: password,
+        MessageAction: 'SUPPRESS',


Does Cognito try to send email if we suppress messaging ?

sobolk · 2024-10-31T17:33:35Z

...egration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/auth/resource.ts

+const customEmailSenderFunction = {
+  handler: funcWithSchedule,
+};


Related to my previous comments.

We shouldn't reuse funcWithSchedule here. Because we'll be blending together two independent scenarios.

We should create a function similar to funcWithSchedule with it's own associated queue. I.e. create similar but isolated setup.

awsluja · 2024-10-31T17:49:02Z

packages/auth-construct/src/types.ts

+/**
+ * CustomEmailSender type for configuring a custom Lambda function for email sending
+ */
+export type CustomEmailSenderConstruct = {


same as above, this should not end with *Construct in the name

rtpascual · 2024-10-31T17:53:22Z

...egration-tests/src/test-projects/data-storage-auth-with-triggers-ts/amplify/auth/resource.ts

+import { defaultNodeFunc, funcWithSchedule } from '../function.js';
+
+const customEmailSenderFunction = {
+  handler: funcWithSchedule,


I agree with what Kamil said about this, funcWithSchedule also has a cron job to invoke it every minute which may make testing this inaccurate.

We would probably want a new/different function with same SQS setup for a different queue and no schedule set. That way only message in the queue will be from when you create a new user in triggerEmailSending and not from scheduled invocations.

…construct

vigy02 added 30 commits September 19, 2024 00:03

fix: clearing the .amplify/generated/env/ before synthesis

743354e

fix: clearing the .amplify/generated/env/ before synthesis

ab7f76f

fix: clearing the .amplify/generated/env/ before synthesis

7c55adc

fix: clearing the .amplify/generated/env/ before synthesis

36727ba

fix: clearing the .amplify/generated/env/ before synthesis

aa2f7d9

fix: clearing the .amplify/generated/env/ before synthesis

0302517

chore: add changeset

0adf873

fix: clearing the .amplify/generated/env/ before synthesis

a5b5d3c

fix: clearing the .amplify/generated/env/ before synthesis

753701a

fix: clearing the .amplify/generated/env/ before synthesis

955cecc

Merge branch 'main' of https://github.com/vigy02/amplify-backend

2a2b188

fix: Clear generated env directory before shim generation

fc0be7e

fix: Clear generated env directory before shim generation

6c916e0

fix: Clear generated env directory before shim generation

cab3f1a

fix: Clear generated env directory before shim generation

954e1c0

chore: add changeset

d9212d8

fix: Clear generated env directory before shim generation

c09e1ee

fix: Clear generated env directory before shim generation

05e1fd5

Merge branch 'issue-dir-clean'

7714224

Merge branch 'aws-amplify:main' into main

91faece

Merge branch 'aws-amplify:main' into main

5977d8f

Merge branch 'main' of github.com:vigy02/amplify-backend

4c6616b

feat: adding custom lambda function trigger for email

cb908ed

feat: adding custom lambda function trigger for email

dbbb9b8

feat: adding custom lambda function trigger for email

2f7e6e8

feat: adding custom lambda function trigger for email

f981039

feat: adding custom lambda function trigger for email

e5ada8b

feat: adding custom lambda function trigger for email

2cc04a9

feat: adding custom lambda function trigger for email

1794ad0

feat: adding custom lambda function trigger for email

e6c6730

vigy02 added 3 commits October 24, 2024 14:34

chore: added changesets

70ae8a1

Added integration tests for customEmailSender

fe1aaf1

updated the API files to reflect master

e06162b

vigy02 requested a review from awsluja October 25, 2024 01:23

sobolk reviewed Oct 25, 2024

View reviewed changes

vigy02 added 15 commits October 29, 2024 11:12

feat: added customSenderEmail with types and added exceptions to esli…

b8d54a6

…nt dict

Merge branch 'main' into feature/custom-email-function

3b03d3c

chore: Updated API

3df2842

chore: Updated API

4f21f21

chore: updated API

c7e53cc

Delete packages/ai-constructs/API.md

e7d335c

chore: Updated API

30ffca8

chore: delete unused file

7411f34

chore: update changeset

1c6bef9

chore: update changeset

65cbf67

chore: Updated API and changeSets

3e898fc

chore: Updated the API from main

445e0a3

API updates to resolve conflicting naming

e4f879b

Updated the types in backend-auth

a26da97

chore: Updated changesets

3e49d70

sobolk reviewed Oct 31, 2024

View reviewed changes

awsluja reviewed Oct 31, 2024

View reviewed changes

rtpascual reviewed Oct 31, 2024

View reviewed changes

vigy02 added 2 commits October 31, 2024 13:18

Added custom Email handler function and refactored the types of auth-…

f5da56c

…construct

chore: updated API

223181c

sobolk approved these changes Oct 31, 2024

View reviewed changes

awsluja approved these changes Oct 31, 2024

View reviewed changes

vigy02 merged commit 11d62fe into main Oct 31, 2024
66 of 69 checks passed

vigy02 deleted the e2e/vigy/feature/custom-email-function branch October 31, 2024 20:49

jamilsaadeh97 mentioned this pull request Nov 1, 2024

[Amplify Gen2] please add a custom sender lambda trigger as a defineAuth's attribute #1607

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add support for custom Lambda function email senders in Auth construct #2087

feat: Add support for custom Lambda function email senders in Auth construct #2087

vigy02 commented Oct 7, 2024 •

edited

Loading

sobolk Oct 25, 2024

sobolk Oct 25, 2024

sobolk Oct 25, 2024

awsluja Oct 25, 2024

josefaidt Oct 28, 2024

sobolk Oct 25, 2024

sobolk Oct 25, 2024

sobolk Oct 25, 2024

sobolk Oct 31, 2024

sobolk Oct 31, 2024

sobolk Oct 31, 2024

sobolk Oct 31, 2024

sobolk Oct 31, 2024

awsluja Oct 31, 2024

rtpascual Oct 31, 2024 •

edited

Loading

rtpascual Oct 31, 2024

		email: Pick<UserPoolSESOptions, 'fromEmail' \| 'fromName' \| 'replyTo'> \| IFunction;
		kmsKeyArn?: string;

		(name) => name.includes('say-hello')
		); // TODO - add func name

	await sqsClient.send(
	new SendMessageCommand({
	QueueUrl: queueUrl,
	MessageBody: messageBody,
	})
	);

	export type CustomEmailSenderConstruct = {
	export type CustomEmailSender = {

feat: Add support for custom Lambda function email senders in Auth construct #2087

feat: Add support for custom Lambda function email senders in Auth construct #2087

Conversation

vigy02 commented Oct 7, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rtpascual Oct 31, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vigy02 commented Oct 7, 2024 •

edited

Loading

rtpascual Oct 31, 2024 •

edited

Loading