aws-ses: EmailIdentity dkimRecords compatibility with Route53

[meza]

Describe the bug

When setting up a new verified email identity with new EmailIdentity, you get back a set of dkim records that you then need to add to your hosted zone.

Unfortunately the records are not fully compatible with an IRecordSet.

Expected Behavior

I would expect the record.name to be compatible with a new CnameRecord

Current Behavior

The dkimRecord names don't have a full stop at the end of them which means that when CDK runs, the domain will end up being duplicated.

Reproduction Steps

const zone = HostedZone.fromLookup(this, 'Zone', {
  domainName: 'example.com'
});
const identity = new EmailIdentity(this, 'Identity', {
  dkimIdentity: DkimIdentity.easyDkim(EasyDkimSigningKeyLength.RSA_2048_BIT),
  dkimSigning: true,
  feedbackForwarding: true,
  identity: Identity.publicHostedZone(zone),
  mailFromBehaviorOnMxFailure: MailFromBehaviorOnMxFailure.REJECT_MESSAGE,
  mailFromDomain: 'mail.example.com'
});

identity.dkimRecords.forEach((record, index) => {
  const cnameRecord = new CnameRecord(this, `dKim_${index}`, {
    domainName: record.value,
    recordName: record.name,
    zone: zone
  });
});

Possible Solution

It would be nice if the record.name would include the full stop.
The workaround is this:

identity.dkimRecords.forEach((record, index) => {
  const cnameRecord = new CnameRecord(this, `dKim_${index}`, {
    domainName: record.value,
    recordName: `${record.name}.`,
    zone: zone
  });
});

---

Another solution would be to have a field that returns the domain keys alone so that we could construct the record names ourselves. Or just return the record name without the domain element.

---

An alternative approach would be to enrich the EmailIdentity with a zone parameter and make it add the records itself.

Additional Information/Context

No response

CDK CLI Version

2.91.0

Framework Version

No response

Node.js Version

v20.5.0

OS

Ubuntu

Language

Typescript

Language Version

Typescript 5.1.6

Other information

No response

[pahud]

Another solution would be to have a field that returns the domain keys alone so that we could construct the record names ourselves. Or just return the record name without the domain element.

This makes sense to me but I am not sure which one is the best solution. Feel free to submit a PR for that if you are interested.

[meza]

Not sure I have the capacity right now but maybe soon. Until then if someone else has it in them to submit a fix, that would be great!