Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Simple Email Service - Mail Manager

Amazon Simple Email Service - Mail Manager (service prefix: ses) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Simple Email Service - Mail Manager
Actions defined by Amazon Simple Email Service - Mail Manager
Permission-only actions for Amazon Simple Email Service - Mail Manager
Resource types defined by Amazon Simple Email Service - Mail Manager
Condition keys for Amazon Simple Email Service - Mail Manager

API operations defined by Amazon Simple Email Service - Mail Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateAddonInstance	ses:CreateAddonInstance			Write
CreateAddonInstance	ses:TagResource			Tagging, Write
CreateAddonSubscription	ses:CreateAddonSubscription			Write
CreateAddonSubscription	ses:TagResource			Tagging, Write
CreateAddressList	ses:CreateAddressList			Write
CreateAddressList	ses:TagResource			Tagging, Write
CreateAddressListImportJob	ses:CreateAddressListImportJob			Write
CreateArchive	ses:CreateArchive			Write
CreateArchive	ses:TagResource			Tagging, Write
CreateIngressPoint	ses:CreateIngressPoint			Write
CreateIngressPoint	ses:TagResource			Tagging, Write
CreateRelay	ses:CreateRelay			Write
CreateRelay	ses:TagResource			Tagging, Write
CreateRuleSet	ses:CreateRuleSet			Write
	ses:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
CreateTrafficPolicy	ses:CreateTrafficPolicy			Write
CreateTrafficPolicy	ses:TagResource			Tagging, Write
DeleteAddonInstance	ses:DeleteAddonInstance			Write
DeleteAddonSubscription	ses:DeleteAddonSubscription			Write
DeleteAddressList	ses:DeleteAddressList			Write
DeleteArchive	ses:DeleteArchive			Write
DeleteIngressPoint	ses:DeleteIngressPoint			Write
DeleteRelay	ses:DeleteRelay			Write
DeleteRuleSet	ses:DeleteRuleSet			Write
DeleteTrafficPolicy	ses:DeleteTrafficPolicy			Write
DeregisterMemberFromAddressList	ses:DeregisterMemberFromAddressList			Write
GetAddonInstance	ses:GetAddonInstance			Read
GetAddonSubscription	ses:GetAddonSubscription			Read
GetAddressList	ses:GetAddressList			Read
GetAddressListImportJob	ses:GetAddressListImportJob			Read
GetArchive	ses:GetArchive			Read
GetArchiveExport	ses:GetArchiveExport			Read
GetArchiveMessage	ses:GetArchiveMessage			Read
GetArchiveMessageContent	ses:GetArchiveMessageContent			Read
GetArchiveSearch	ses:GetArchiveSearch			Read
GetArchiveSearchResults	ses:GetArchiveSearchResults			Read
GetIngressPoint	ses:GetIngressPoint			Read
GetMemberOfAddressList	ses:GetMemberOfAddressList			Read
GetRelay	ses:GetRelay			Read
GetRuleSet	ses:GetRuleSet			Read
GetTrafficPolicy	ses:GetTrafficPolicy			Read
ListAddonInstances	ses:ListAddonInstances			List
ListAddonSubscriptions	ses:ListAddonSubscriptions			List
ListAddressListImportJobs	ses:ListAddressListImportJobs			List
ListAddressLists	ses:ListAddressLists			List
ListArchiveExports	ses:ListArchiveExports			List
ListArchiveSearches	ses:ListArchiveSearches			List
ListArchives	ses:ListArchives			List
ListIngressPoints	ses:ListIngressPoints			List
ListMembersOfAddressList	ses:ListMembersOfAddressList			List
ListRelays	ses:ListRelays			List
ListRuleSets	ses:ListRuleSets			List
ListTagsForResource	ses:ListTagsForResource			Read
ListTrafficPolicies	ses:ListTrafficPolicies			List
RegisterMemberToAddressList	ses:RegisterMemberToAddressList			Write
StartAddressListImportJob	ses:StartAddressListImportJob			Write
StartArchiveExport	ses:StartArchiveExport			Write
StartArchiveSearch	ses:StartArchiveSearch			Write
StopAddressListImportJob	ses:StopAddressListImportJob			Write
StopArchiveExport	ses:StopArchiveExport			Write
StopArchiveSearch	ses:StopArchiveSearch			Write
TagResource	ses:TagResource			Tagging, Write
UntagResource	ses:UntagResource			Tagging, Write
UpdateArchive	ses:UpdateArchive			Write
UpdateIngressPoint	ses:UpdateIngressPoint			Write
UpdateRelay	ses:UpdateRelay			Write
UpdateRuleSet	ses:UpdateRuleSet			Write
UpdateRuleSet	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
UpdateTrafficPolicy	ses:UpdateTrafficPolicy			Write

Actions defined by Amazon Simple Email Service - Mail Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAddonInstance	Grants permission to create an addon instance	addon-instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:AddonSubscriptionArn	Write
CreateAddonSubscription	Grants permission to create an addon subscription	addon-subscription*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAddressList	Grants permission to create an address list	mailmanager-address-list*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAddressListImportJob	Grants permission to create an import job on an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
CreateArchive	Grants permission to create an archive	mailmanager-archive*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIngressPoint	Grants permission to create an ingress point	mailmanager-ingress-point*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:MailManagerIngressPointType ses:MailManagerRuleSetArn ses:MailManagerTrafficPolicyArn	Write
CreateRelay	Grants permission to create a SMTP relay	mailmanager-smtp-relay*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRuleSet	Grants permission to create a rule set	mailmanager-rule-set*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTrafficPolicy	Grants permission to create a traffic policy	mailmanager-traffic-policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAddonInstance	Grants permission to delete an addon instance	addon-instance*	aws:ResourceTag/${TagKey}	Write
DeleteAddonSubscription	Grants permission to delete an addon subscription	addon-subscription*	aws:ResourceTag/${TagKey}	Write
DeleteAddressList	Grants permission to delete an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
DeleteArchive	Grants permission to delete an archive	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
DeleteIngressPoint	Grants permission to delete an ingress point	mailmanager-ingress-point*	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType	Write
DeleteRelay	Grants permission to delete a SMTP relay	mailmanager-smtp-relay*	aws:ResourceTag/${TagKey}	Write
DeleteRuleSet	Grants permission to delete a rule set	mailmanager-rule-set*	aws:ResourceTag/${TagKey}	Write
DeleteTrafficPolicy	Grants permission to delete a traffic point	mailmanager-traffic-policy*	aws:ResourceTag/${TagKey}	Write
DeregisterMemberFromAddressList	Grants permission to remove a member from an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
GetAddonInstance	Grants permission to get information about an addon instance	addon-instance*	aws:ResourceTag/${TagKey}	Read
GetAddonSubscription	Grants permission to get information about an addon subscription	addon-subscription*	aws:ResourceTag/${TagKey}	Read
GetAddressList	Grants permission to get information about an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Read
GetAddressListImportJob	Grants permission to get information about an import job on an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Read
GetArchive	Grants permission to get information about an archive	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetArchiveExport	Grants permission to get information about an archive export	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetArchiveMessage	Grants permission to retrieve archived message	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetArchiveMessageContent	Grants permission to retrieve archived message content	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetArchiveSearch	Grants permission to get information about a search	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetArchiveSearchResults	Grants permission to get information about search results	mailmanager-archive*	aws:ResourceTag/${TagKey}	Read
GetIngressPoint	Grants permission to get information about an ingress point	mailmanager-ingress-point*	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType	Read
GetMemberOfAddressList	Grants permission to get information about a member in an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Read
GetRelay	Grants permission to get information about a SMTP relay	mailmanager-smtp-relay*	aws:ResourceTag/${TagKey}	Read
GetRuleSet	Grants permission to get information about a rule set	mailmanager-rule-set*	aws:ResourceTag/${TagKey}	Read
GetTrafficPolicy	Grants permission to get information about a traffic policy	mailmanager-traffic-policy*	aws:ResourceTag/${TagKey}	Read
ListAddonInstances	Grants permission to list all of the addon instances associated with your account			List
ListAddonSubscriptions	Grants permission to list all of the addon subscriptions associated with your account			List
ListAddressListImportJobs	Grants permission to list all of the import jobs associated with an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	List
ListAddressLists	Grants permission to list all of the address lists associated with your account			List
ListArchiveExports	Grants permission to list all of the archive exports associated with your account			List
ListArchiveSearches	Grants permission to list all of the archive searches associated with your account			List
ListArchives	Grants permission to list all of the archives associated with your account			List
ListIngressPoints	Grants permission to list all of the ingress points associated with your account			List
ListMembersOfAddressList	Grants permission to list all of the members associated with an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	List
ListRelays	Grants permission to list all of the SMTP relays associated with your account			List
ListRuleSets	Grants permission to list all of the rule sets associated with your account			List
ListTagsForResource	Grants permission to list all of the tags associated with the resource	addon-instance	aws:ResourceTag/${TagKey}	Read
		addon-subscription	aws:ResourceTag/${TagKey}
		mailmanager-archive	aws:ResourceTag/${TagKey}
		mailmanager-ingress-point	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType
		mailmanager-rule-set	aws:ResourceTag/${TagKey}
		mailmanager-smtp-relay	aws:ResourceTag/${TagKey}
		mailmanager-traffic-policy	aws:ResourceTag/${TagKey}
ListTrafficPolicies	Grants permission to list all of the traffic policies associated with your account			List
RegisterMemberToAddressList	Grants permission to add a member to an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
StartAddressListImportJob	Grants permission to start an import job on an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
StartArchiveExport	Grants permission to start an archive export	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
StartArchiveSearch	Grants permission to start an archive search	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
StopAddressListImportJob	Grants permission to stop an ongoing import job on an address list	mailmanager-address-list*	aws:ResourceTag/${TagKey}	Write
StopArchiveExport	Grants permission to stop archive export	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
StopArchiveSearch	Grants permission to stop archive search	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add one or more tags (keys and values) to a specified resource	addon-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		addon-subscription	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-address-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-archive	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-ingress-point	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:MailManagerIngressPointType
		mailmanager-rule-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-smtp-relay	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-traffic-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags (keys and values) from a specified resource	addon-instance	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		addon-subscription	aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-address-list	aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-archive	aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-ingress-point	aws:ResourceTag/${TagKey} aws:TagKeys ses:MailManagerIngressPointType
		mailmanager-rule-set	aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-smtp-relay	aws:ResourceTag/${TagKey} aws:TagKeys
		mailmanager-traffic-policy	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateArchive	Grants permission to update an archive	mailmanager-archive*	aws:ResourceTag/${TagKey}	Write
UpdateIngressPoint	Grants permission to update an ingress point	mailmanager-ingress-point*	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType ses:MailManagerRuleSetArn ses:MailManagerTrafficPolicyArn	Write
UpdateRelay	Grants permission to update a SMTP relay	mailmanager-smtp-relay*	aws:ResourceTag/${TagKey}	Write
UpdateRuleSet	Grants permission to update a rule set	mailmanager-rule-set*	aws:ResourceTag/${TagKey}	Write
UpdateTrafficPolicy	Grants permission to update a traffic policy	mailmanager-traffic-policy*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Simple Email Service - Mail Manager

The following actions are defined by Amazon Simple Email Service - Mail Manager but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for Mail Manager resources	mailmanager-ingress-point	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType	Permissions management, Write
mailmanager-rule-set	aws:ResourceTag/${TagKey}

Actions

Description

Resource types (*required)

Condition keys

Access level

AllowVendedLogDeliveryForResource

Grants permission to configure vended log delivery for Mail Manager resources

mailmanager-ingress-point

aws:ResourceTag/${TagKey}

ses:MailManagerIngressPointType

Permissions management, Write

mailmanager-rule-set

aws:ResourceTag/${TagKey}

Resource types defined by Amazon Simple Email Service - Mail Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
addon-instance	arn:${Partition}:ses:${Region}:${Account}:addon-instance/${AddonInstanceId}	aws:ResourceTag/${TagKey}
addon-subscription	arn:${Partition}:ses:${Region}:${Account}:addon-subscription/${AddonSubscriptionId}	aws:ResourceTag/${TagKey}
mailmanager-address-list	arn:${Partition}:ses:${Region}:${Account}:mailmanager-address-list/${AddressListId}	aws:ResourceTag/${TagKey}
mailmanager-archive	arn:${Partition}:ses:${Region}:${Account}:mailmanager-archive/${ArchiveId}	aws:ResourceTag/${TagKey}
mailmanager-ingress-point	arn:${Partition}:ses:${Region}:${Account}:mailmanager-ingress-point/${IngressPointId}	aws:ResourceTag/${TagKey} ses:MailManagerIngressPointType
mailmanager-rule-set	arn:${Partition}:ses:${Region}:${Account}:mailmanager-rule-set/${RuleSetId}	aws:ResourceTag/${TagKey}
mailmanager-smtp-relay	arn:${Partition}:ses:${Region}:${Account}:mailmanager-smtp-relay/${RelayId}	aws:ResourceTag/${TagKey}
mailmanager-traffic-policy	arn:${Partition}:ses:${Region}:${Account}:mailmanager-traffic-policy/${TrafficPolicyId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Simple Email Service - Mail Manager

Amazon Simple Email Service - Mail Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
ses:AddonSubscriptionArn	Filters access by SES Addon Subscription ARN	ARN
ses:MailManagerIngressPointType	Filters access by SES Mail Manager ingress point type, for example OPEN or AUTH	String
ses:MailManagerRuleSetArn	Filters access by SES Mail Manager rule set ARN	ARN
ses:MailManagerTrafficPolicyArn	Filters access by SES Mail Manager traffic policy ARN	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon SES (ses)

Amazon Simple Email Service v2 (ses)