aws-cloudformation - 配置 Cognito 用户池以使用位于 ap-southeast-2 的 SES 发送电子邮件

Question

我有以下 cloudformation 模板(它是 serverless.yml 模板的一部分)来创建使用 SES 发送电子邮件的 Cognito UserPool。

我正在 ap-southeast-2 上部署我的无服务器项目，并且我想使用同一区域发送电子邮件。我已经在 ap-southeast-2 中预先验证了 SES 模板中的帐户，但是如果我将下面模板(最后一行)中的 SourceArn 替换为 ap-southeast-2 (或无服务器伪变量 #{AWS::Region} )区域我收到错误:

An error occurred: CognitoUserPool - Unable to send email message, please try again (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: InvalidParameterException; Request ID: ...).

当我用 us-west-2 替换该区域时(如下面的模板所示)，它有效。为什么是ap-southeast-2如果允许我使用该地区的 SES，则不支持？

  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      # Generate a name based on the stage
      UserPoolName: ${self:provider.stage}-user-pool
      # Set email as an alias
      AutoVerifiedAttributes:
        - email
      # UsernameAttributes and AliasAttributes are mutually exclusive configuration options
      AliasAttributes: # instead of UsernameAttributes:
        - preferred_username
        - email
      UsernameConfiguration:
        CaseSensitive: false
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: verified_email
            Priority: 1
      AdminCreateUserConfig:
        UnusedAccountValidityDays: 5
        AllowAdminCreateUserOnly: false
      Policies:
        PasswordPolicy:
          MinimumLength: 10
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
      Schema:
        - Name: membershipType
          Required: false
          Mutable: true
          AttributeDataType: String
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_LINK
        EmailMessageByLink: "Please click on the following link to verify: {##Verify Email##}"
        EmailSubjectByLink: Please confirm your registration 
      EmailConfiguration:
        EmailSendingAccount: DEVELOPER
        From: <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="264b5f66434b474f4a0845494b" rel="noreferrer noopener nofollow">[email protected]</a>
        ReplyToEmailAddress: <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="90fde9d0f5fdf1f9fcbef3fffd" rel="noreferrer noopener nofollow">[email protected]</a>
        SourceArn: arn:aws:ses:us-west-2:#{AWS::AccountId}:identity/<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="412c3801242c20282d6f222e2c" rel="noreferrer noopener nofollow">[email protected]</a>

Answer 1

ap-southeast-2 中不支持此功能。在 AWS 在新区域提供支持之前，我们无法做太多事情。

来自docs :

Available regions for Amazon SES are US East (N. Virginia)us-east-1, US West (Oregon) us-west-2, and Europe (Ireland)eu-west-1. Amazon SES doesn't support email receiving in the following Regions: Asia Pacific (Mumbai), Asia Pacific (Sydney), Canada (Central), Europe (Frankfurt), Europe (London), South America (São Paulo), and AWS GovCloud (US).