diff --git a/lambdas/email_attachment_saver/lambda.tf b/lambdas/email_attachment_saver/lambda.tf
index 097fb21..6887254 100644
--- a/lambdas/email_attachment_saver/lambda.tf
+++ b/lambdas/email_attachment_saver/lambda.tf
@@ -44,7 +44,7 @@ module "lambda_function_container_image" {
         "s3-object-lambda:List*",
         "s3-object-lambda:WriteGetObjectResponse"
       ]
-      resources = var.allowed_s3_resources
+      resources = ["${var.allowed_s3_resources}/*"]
     }
 
     log_write = {
diff --git a/state_machines/email_form_fill/state_machine.tf b/state_machines/email_form_fill/state_machine.tf
index 7f83ed4..3c86303 100644
--- a/state_machines/email_form_fill/state_machine.tf
+++ b/state_machines/email_form_fill/state_machine.tf
@@ -73,55 +73,55 @@ resource "aws_sfn_state_machine" "sfn_state_machine" {
   role_arn = aws_iam_role.iam_for_sfn.arn
   definition = jsonencode({
   "Comment": "A description of my state machine",
-  "StartAt": "Parallel",
+  "StartAt": "Map SES email",
   "States": {
+    "Map SES email": {
+      "Type": "Pass",
+      "Next": "Parallel",
+      "Parameters": {
+        "email_id.$": "$.Records[0].ses.mail.messageId",
+        "destination_email.$": "$.Records[0].ses.mail.destination",
+        "sender_email.$": "$.Records[0].ses.mail.source",
+        "bucket": var.workspace_bucket_name,
+        "raw_email_key.$": "States.Format('rfp/raw_emails/{}', $.Records[0].ses.mail.messageId)"
+      },
+      "Comment": "Map an SES email for easier consumption later on in the sate machine:\n\nemail_id: the ID of the email\ndestination_email: the destination of the email\nsender_email: the sender of the email\nbucket: the  S3 bucket in which all operations should take place in\nraw_email_key: the s3 key to the raw email. See the SES \"Deliver to S3 Bucket\" action"
+    },
     "Parallel": {
-      "Type": "Parallel",
       "Branches": [
         {
           "StartAt": "Store Email Medata",
           "States": {
             "Store Email Medata": {
+              "End": true,
               "Parameters": {
-                "Body": {
-                  "destination_email.$": "$.Records[0].ses.mail.destination",
-                  "email_id.$": "$.Records[0].ses.mail.messageId",
-                  "prompts": [
-                    {
-                      "answer": "",
-                      "key": "A",
-                      "prompt": ""
-                    }
-                  ],
-                  "sender_email.$": "$.Records[0].ses.mail.source"
-                },
-                "Bucket": var.workspace_bucket_name,
-                "Key.$": "States.Format('{}/email', $.Records[0].ses.mail.messageId)"
+                "Body.$": "$",
+                "Bucket.$": "$.bucket",
+                "Key.$": "States.Format('rfp/{}/email', $.email_id)"
               },
               "Resource": "arn:aws:states:::aws-sdk:s3:putObject",
               "Type": "Task",
-              "End": true
+              "Comment": "Stores the input in the specified bucket/key"
             }
           }
         },
         {
-          "StartAt": "Extract and store email attachments in S3",
+          "StartAt": "Download email attachments",
           "States": {
-            "Extract and store email attachments in S3": {
-              "End": true,
+            "Download email attachments": {
+              "Type": "Task",
+              "Resource": "arn:aws:states:::lambda:invoke",
               "OutputPath": "$.Payload",
               "Parameters": {
                 "FunctionName": var.attachment_saver_lambda_name,
                 "Payload": {
-                  "email_content.$": "$.Records[0].ses.mail.content",
-                  "s3_folder_key.$ ": "$.Records[0].ses.mail.messageId",
-                  "bucket": var.workspace_bucket_name
+                  "s3_folder_key.$": "States.Format('rfp/{}/attachments', $.email_id)",
+                  "bucket.$": "$.bucket",
+                  "s3_email_key.$": "$.raw_email_key"
                 }
               },
-              "Resource": "arn:aws:states:::lambda:invoke",
               "Retry": [
                 {
-                  "BackoffRate": 2,
                   "ErrorEquals": [
                     "Lambda.ServiceException",
                     "Lambda.AWSLambdaException",
@@ -129,15 +129,18 @@ resource "aws_sfn_state_machine" "sfn_state_machine" {
                     "Lambda.TooManyRequestsException"
                   ],
                   "IntervalSeconds": 1,
-                  "MaxAttempts": 3
+                  "MaxAttempts": 3,
+                  "BackoffRate": 2
                 }
               ],
-              "Type": "Task"
+              "End": true,
+              "Comment": "Extract attachments from a raw email MIME file and stores them in S3"
             }
           }
         }
       ],
-      "End": true
+      "End": true,
+      "Type": "Parallel"
     }
   }
 })