feat: add tofu setup for SMS

infra/tofu_importable_modules/bloom_deployer_permission_set_policy/main.tf

@@ -89,11 +89,24 @@ data "aws_iam_policy_document" "deployer" {
       "servicediscovery:Discover*",
       "servicediscovery:Get*",
       "servicediscovery:List*",
+      "sms-voice:DescribePhoneNumbers",
       "sso:Get*",
       "sso:List*",
     ]
     resources = ["*"]
   }
+  statement {
+    # Allow managing the Pinpoint SMS Voice V2 phone number used for SMS MFA.
+    actions = [
+      "sms-voice:ListTagsForResource",
+      "sms-voice:ReleasePhoneNumber",
+      "sms-voice:RequestPhoneNumber",
+      "sms-voice:TagResource",
+      "sms-voice:UntagResource",
+      "sms-voice:UpdatePhoneNumber",
+    ]
+    resources = ["arn:aws:sms-voice:${local.region_account}:phone-number/*"]
+  }
   statement {
     # Allow any cloudshell action.
     actions = [

infra/tofu_importable_modules/bloom_deployment/ecs.tf

@@ -132,6 +132,11 @@ locals {
             Effect   = "Allow"
             Resource = aws_prometheus_workspace.bloom.arn
           },
+          {
+            Action   = "sms-voice:SendTextMessage"
+            Effect   = "Allow"
+            Resource = "*"
+          },
         ]
       })
     }

infra/tofu_importable_modules/bloom_deployment/ecs_api_service.tf

@@ -14,6 +14,9 @@ locals {
     S3_PRIVATE_BUCKET           = aws_s3_bucket.private.id
     S3_PUBLIC_BUCKET            = aws_s3_bucket.public.id
     OTEL_EXPORTER_OTLP_ENDPOINT = "http://127.0.0.1:4317"
+    SMS_PROVIDER                = var.bloom_api_sms_config == null ? "" : "aws"
+    AWS_SMS_REGION              = var.bloom_api_sms_config == null ? "" : var.aws_region
+    AWS_SMS_ORIGINATION_NUMBER  = var.bloom_api_sms_config == null ? "" : aws_pinpointsmsvoicev2_phone_number.api_sms[0].phone_number
   }
 }
 resource "aws_ecs_task_definition" "bloom_api" {

infra/tofu_importable_modules/bloom_deployment/main.tf

@@ -281,6 +281,21 @@ variable "grafana_editor_group_ids" {
   default     = []
 }
 
+variable "bloom_api_sms_config" {
+  description = "SMS configuration for the Bloom API using AWS Pinpoint SMS Voice V2. When set, provisions a phone number and configures the API to send SMS via AWS."
+  type = object({
+    number_type = optional(string, "LONG_CODE")
+  })
+  default = null
+  validation {
+    condition = var.bloom_api_sms_config == null || contains(
+      ["LONG_CODE", "TOLL_FREE", "SHORT_CODE", "TEN_DLC"],
+      var.bloom_api_sms_config.number_type
+    )
+    error_message = "number_type must be one of: LONG_CODE, TOLL_FREE, SHORT_CODE, TEN_DLC."
+  }
+}
+
 # Create a CloudTrail data store so that audit events are query-able in SQL.
 resource "aws_cloudtrail_event_data_store" "audit" {
   count = local.is_prod ? 1 : 0

infra/tofu_importable_modules/bloom_deployment/sms.tf

@@ -0,0 +1,13 @@
+resource "aws_pinpointsmsvoicev2_phone_number" "api_sms" {
+  count            = var.bloom_api_sms_config != null ? 1 : 0
+  region           = var.aws_region
+  iso_country_code = "US"
+  message_type         = "TRANSACTIONAL"
+  number_type          = var.bloom_api_sms_config.number_type
+  number_capabilities  = ["SMS"]
+}
+
+output "sms_phone_number" {
+  value       = one(aws_pinpointsmsvoicev2_phone_number.api_sms[*].phone_number)
+  description = "Phone number provisioned for sending SMS (E.164 format). Null if SMS is not configured."
+}