serverless.yml

service: ses-forwarder 

provider:
  name: aws
  runtime: nodejs6.10

  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "ses:SendRawEmail"
      Resource: "*"
    - Effect: "Allow"
      Action: 
        - s3:GetObject
        - s3:PutObject
      Resource: { "Fn::Join" : ["", ["arn:aws:s3:::", { "Ref" : "SesForwarderBucket" }, "/*" ] ]  }

functions:
  sesForwarder:
    handler: handler.handle
    timeout: 10
    memorySize: 128
    environment:
      emailBucket: 
         Ref: SesForwarderBucket

resources:
 Resources:
   SesForwarderBucket:
     Type: AWS::S3::Bucket
     Properties:
      BucketName: 
        Fn::Join: ["", ["sesforwarder-",{ "Ref" : "AWS::AccountId" }  ] ]
      LifecycleConfiguration:
        Rules:
           - ExpirationInDays: 3
             Status: Enabled
   SesForwarderBucketPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: 
           Ref: SesForwarderBucket
        PolicyDocument:

          Version: '2012-10-17'
          Statement:
          - Sid: GiveSESPermissionToWriteEmail
            Effect: Allow
            Principal:
              Service: ses.amazonaws.com
            Action: s3:PutObject
            Resource: 
               Fn::Join: ["", ["arn:aws:s3:::",{"Ref":"SesForwarderBucket" },"/*"]]
            Condition:
              StringEquals:
                aws:Referer:
                    Ref: AWS::AccountId   
     
 Outputs:
    SesForwarderBucket:
      Description: "Forwarder Bucket Name"
      Value:
         Ref: SesForwarderBucket