#!/usr/bin/env bash
# check.sh: what Amazon WorkMail's export will NOT carry, for YOUR organization.
# Read-only AWS CLI calls with your own credentials/profile. Nothing is sent anywhere else.
# WorkMail end of support: 2027-03-31.
#   bash check.sh <organization-id> [region]      (list orgs: aws workmail list-organizations)
#   bash check.sh --demo
set -euo pipefail
SRC_EOS=https://docs.aws.amazon.com/workmail/latest/adminguide/workmail-end-of-support.html
SRC_EXP=https://docs.aws.amazon.com/workmail/latest/adminguide/mail-export.html
if [ "${1:-}" = "--demo" ]; then
  USERS=42; ALIASES=17; DLISTS=6; RESOURCES=3; DOMAINS=2; RULESET="workmail-rules (4 rules)"; JOURNAL="enabled"; DEMO=" [DEMO DATA]"
else
  ORG="${1:?usage: bash check.sh <organization-id> [region] | --demo}"; R="${2:-${AWS_REGION:-us-east-1}}"; DEMO=""
  wm(){ aws workmail "$@" --organization-id "$ORG" --region "$R" --output text; }
  USERS=$(wm list-users --query 'length(Users[?State==`ENABLED`])')
  ALIASES=0
  for id in $(wm list-users --query 'Users[?State==`ENABLED`].Id'); do
    n=$(aws workmail list-aliases --organization-id "$ORG" --entity-id "$id" --region "$R" --query 'length(Aliases)' --output text); ALIASES=$((ALIASES+n))
  done
  DLISTS=$(wm list-groups --query 'length(Groups[?State==`ENABLED`])')
  RESOURCES=$(wm list-resources --query 'length(Resources[?State==`ENABLED`])')
  DOMAINS=$(wm list-mail-domains --query 'length(MailDomains)')
  RULESET=$(aws ses describe-active-receipt-rule-set --region "$R" --query '[Metadata.Name, length(Rules)]' --output text 2>/dev/null | awk '{print $1" ("$2" rules)"}' || echo "none/unknown")
  JOURNAL=$(wm describe-email-monitoring-configuration --query 'LogGroupArn' 2>/dev/null | grep -q arn && echo enabled || echo "not configured")
fi
days=$(( ( $(date -j -f %F 2027-03-31 +%s 2>/dev/null || date -d 2027-03-31 +%s) - $(date +%s) ) / 86400 ))
cat <<OUT
Amazon WorkMail end of support: 2027-03-31 ($days days).$DEMO

EXPORTED by StartMailboxExportJob:      email messages and calendar items, for $USERS active mailboxes
NOT EXPORTED (per AWS):                  "Other items, such as contacts and tasks, are not exported"; notes too
                                         $SRC_EXP
REBUILD BY HAND in the new provider:
  aliases                                $ALIASES
  groups (distribution lists)            $DLISTS
  resources (rooms/equipment)            $RESOURCES
  mail domains (MX/SPF/DKIM/autodiscover) $DOMAINS
  SES inbound receipt rule set           $RULESET
  email monitoring / journaling          $JOURNAL

Also: the export needs S3, KMS and IAM ("The ability to program" is a listed prerequisite).
Community reports (not AWS-confirmed): IMAP migrations throttled (one team moved 3,500 of 300,000 mails in a week),
and a community-built DIY WorkMail -> Microsoft 365 route writes through EWS, which Microsoft disables 2027-04-01, one day later.
$SRC_EOS
OUT