How to create an user pool only after domain identity verification

[mzalins]

Hi,
I am trying to verify a domain identity in AWS SES and after that use it in a user pool for email sending.

const verifyDomainIdentity = new AwsCustomResource(this, 'VerifyDomainIdentity', {
  onCreate: {
      service: 'SES',
      action: 'verifyDomainIdentity',
      region: 'us-east-1',
      parameters: {
          Domain: emailDomain,
      },
      physicalResourceId: PhysicalResourceId.fromResponse('VerificationToken'),
  },
  policy: AwsCustomResourcePolicy.fromStatements([
      new PolicyStatement({
          actions: ['ses:VerifyDomainIdentity', 'ses:DeleteIdentity'],
          effect: Effect.ALLOW,
          resources: ['*'],
      }),
  ]),
});

new TxtRecord(this, 'SESVerificationRecord', {
  zone,
  recordName: emailDomain,
  values: [verifyDomainIdentity.getResponseField('VerificationToken')],
});

const userPool = new UserPool(this, `${PREFIX}UserPool`, {
  email: UserPoolEmail.withSES({
      sesRegion: 'us-east-1',
      fromEmail: `no-reply@${emailDomain}`,
      replyTo: `no-reply@${emailDomain}`,
      sesVerifiedDomain: emailDomain,
  }),
  ...
});

On a user pool creation, an error is returned - "Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified.".

The domain identity is created and verified successfully. Therefore, if the code is run twice - first without adding SES email to the user pool, and with adding email, then the second time the already created and verified domain identity can be successfully used in the user pool. I assume that the problem is that the identity does not have time to be created and verified before the creation of the user pool.

Thank you