serverless.yml

service: sesreceiver

provider:
  name: aws
  runtime: nodejs12.x
  region: eu-west-1
  profile: # Your aws iam profile
  iamRoleStatements:
    - Effect: Allow
      Action:
        - s3:*
      Resource: "*"

custom:
  bucket: contactmails

functions:
  postProcess:
    handler: handler.postProcess

resources:
  Resources:
    S3EMailBucketPermissions:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: 
          Ref: # Your bucket ref
        PolicyDocument:
          Statement:
            - Principal: 
                Service: "ses.amazonaws.com"
              Action:
                - s3:PutObject
              Effect: Allow
              Sid: "AllowSESPuts"
              Resource: 
                Fn::Join: ['', ['arn:aws:s3:::', Ref: "contatctmails", '/*'] ]
              Condition:
                StringEquals:
                  "aws:Referer": { Ref: AWS::AccountId }