Email-to-Ticket

Architecture

The email-to-ticket feature converts inbound emails to StackFlow incidents automatically. SES receives incoming emails at the configured address, publishes them to the SNS topic stackflow-inbound-email, which delivers to the StackFlow-Events-Ingestion.fifo SQS queue. The StackFlowAPI Lambda processes the queued message, parses the email, and creates the incident record.

Inbound Email (tickets@your-instance.stackflow-tech.com)
    │
    ▼
Amazon SES Receiving (Rule Set)
    │
    ▼
SNS Topic (stackflow-inbound-email)
    │
    ▼
SQS FIFO (StackFlow-Events-Ingestion.fifo)
    │
    ▼
StackFlowAPI Lambda → Aurora PostgreSQL (INC created)

Mailbox Configuration

Configure the inbound email address in SES receiving rules. The receiving rule should store the raw email to an S3 bucket (for parsing) and publish a notification to SNS. Configure the recipient address in StackFlow System Properties (email.to_ticket_address).

aws ses create-receipt-rule   --rule-set-name stackflow-inbound   --rule '{
    "Name": "inbound-to-ticket",
    "Recipients": ["tickets@your-instance.stackflow-tech.com"],
    "Actions": [
      {"S3Action": {"BucketName": "stackflow-email-inbox", "ObjectKeyPrefix": "inbound/"}},
      {"SNSAction": {"TopicArn": "arn:aws:sns:us-east-1:373544523367:stackflow-inbound-email"}}
    ],
    "Enabled": true,
    "ScanEnabled": true
  }'   --region us-east-1

Parsing Rules

The email parser extracts incident fields from the email content. The subject line becomes the short description. The body becomes the description. The sender's email address is matched against Cognito users to identify the reporter. Custom parsing rules can extract additional fields from structured email formats (e.g., monitoring alerts with a predefined format).

Auto-Response

An auto-response email is sent to the reporter when their email creates an incident. The auto-response includes the incident number, a link to track the ticket, and the SLA target for the detected priority. The auto-response uses the email_to_ticket_confirmation SES template.

Spam Filtering

SES spam scanning is enabled on the inbound rule set. Emails with spam scores above the threshold are quarantined (stored in S3 but not processed) rather than deleted. Quarantined emails can be reviewed and manually processed from Admin → Notifications → Email Quarantine. Common false positives are monitoring alerts from new systems — add their sender addresses to the allowlist.