Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Simple Email Service v2

Amazon Simple Email Service v2 (service prefix: ses) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Simple Email Service v2
Actions defined by Amazon Simple Email Service v2
Permission-only actions for Amazon Simple Email Service v2
Resource types defined by Amazon Simple Email Service v2
Condition keys for Amazon Simple Email Service v2

API operations defined by Amazon Simple Email Service v2

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchGetMetricData	ses:BatchGetMetricData			Read
CancelExportJob	ses:CancelExportJob			Write
CreateConfigurationSet	ses:CreateConfigurationSet			Write
CreateConfigurationSet	ses:TagResource			Tagging, Write
CreateConfigurationSetEventDestination	ses:CreateConfigurationSetEventDestination			Write
CreateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
CreateContact	ses:CreateContact			Write
CreateContactList	ses:CreateContactList			Write
CreateContactList	ses:TagResource			Tagging, Write
CreateCustomVerificationEmailTemplate	ses:CreateCustomVerificationEmailTemplate			Write
CreateCustomVerificationEmailTemplate	ses:TagResource			Tagging, Write
CreateDedicatedIpPool	ses:CreateDedicatedIpPool			Write
CreateDedicatedIpPool	ses:TagResource			Tagging, Write
CreateDeliverabilityTestReport	ses:CreateDeliverabilityTestReport			Write
CreateDeliverabilityTestReport	ses:TagResource			Tagging, Write
CreateEmailIdentity	ses:CreateEmailIdentity			Write
CreateEmailIdentity	ses:TagResource			Tagging, Write
CreateEmailIdentityPolicy	ses:CreateEmailIdentityPolicy			Permissions management, Write
CreateEmailTemplate	ses:CreateEmailTemplate			Write
CreateEmailTemplate	ses:TagResource			Tagging, Write
CreateExportJob	ses:CreateExportJob			Write
CreateImportJob	ses:CreateImportJob			Write
CreateMultiRegionEndpoint	ses:CreateMultiRegionEndpoint			Write
CreateMultiRegionEndpoint	ses:TagResource			Tagging, Write
CreateTenant	ses:CreateTenant			Write
CreateTenant	ses:TagResource			Tagging, Write
CreateTenantResourceAssociation	ses:CreateTenantResourceAssociation			Write
DeleteConfigurationSet	ses:DeleteConfigurationSet			Write
DeleteConfigurationSetEventDestination	ses:DeleteConfigurationSetEventDestination			Write
DeleteContact	ses:DeleteContact			Write
DeleteContactList	ses:DeleteContactList			Write
DeleteCustomVerificationEmailTemplate	ses:DeleteCustomVerificationEmailTemplate			Write
DeleteDedicatedIpPool	ses:DeleteDedicatedIpPool			Write
DeleteEmailIdentity	ses:DeleteEmailIdentity			Write
DeleteEmailIdentityPolicy	ses:DeleteEmailIdentityPolicy			Permissions management, Write
DeleteEmailTemplate	ses:DeleteEmailTemplate			Write
DeleteMultiRegionEndpoint	ses:DeleteMultiRegionEndpoint			Write
DeleteSuppressedDestination	ses:DeleteSuppressedDestination			Write
DeleteTenant	ses:DeleteTenant			Write
DeleteTenantResourceAssociation	ses:DeleteTenantResourceAssociation			Write
GetAccount	ses:GetAccount			Read
GetBlacklistReports	ses:GetBlacklistReports			Read
GetConfigurationSet	ses:GetConfigurationSet			Read
GetConfigurationSetEventDestinations	ses:GetConfigurationSetEventDestinations			Read
GetContact	ses:GetContact			Read
GetContactList	ses:GetContactList			Read
GetCustomVerificationEmailTemplate	ses:GetCustomVerificationEmailTemplate			Read
GetDedicatedIp	ses:GetDedicatedIp			Read
GetDedicatedIpPool	ses:GetDedicatedIpPool			Read
GetDedicatedIps	ses:GetDedicatedIps			Read
GetDeliverabilityDashboardOptions	ses:GetDeliverabilityDashboardOptions			Read
GetDeliverabilityTestReport	ses:GetDeliverabilityTestReport			Read
GetDomainDeliverabilityCampaign	ses:GetDomainDeliverabilityCampaign			Read
GetDomainStatisticsReport	ses:GetDomainStatisticsReport			Read
GetEmailAddressInsights	ses:GetEmailAddressInsights			Read
GetEmailIdentity	ses:GetEmailIdentity			Read
GetEmailIdentityPolicies	ses:GetEmailIdentityPolicies			Read
GetEmailTemplate	ses:GetEmailTemplate			Read
GetExportJob	ses:GetExportJob			Read
GetImportJob	ses:GetImportJob			Read
GetMessageInsights	ses:GetMessageInsights			Read
GetMultiRegionEndpoint	ses:GetMultiRegionEndpoint			Read
GetReputationEntity	ses:GetReputationEntity			Read
GetSuppressedDestination	ses:GetSuppressedDestination			Read
GetTenant	ses:GetTenant			Read
ListConfigurationSets	ses:ListConfigurationSets			List
ListContactLists	ses:ListContactLists			List
ListContacts	ses:ListContacts			List
ListCustomVerificationEmailTemplates	ses:ListCustomVerificationEmailTemplates			List
ListDedicatedIpPools	ses:ListDedicatedIpPools			List
ListDeliverabilityTestReports	ses:ListDeliverabilityTestReports			List
ListDomainDeliverabilityCampaigns	ses:ListDomainDeliverabilityCampaigns			Read
ListEmailIdentities	ses:ListEmailIdentities			List
ListEmailTemplates	ses:ListEmailTemplates			List
ListExportJobs	ses:ListExportJobs			List
ListImportJobs	ses:ListImportJobs			List
ListMultiRegionEndpoints	ses:ListMultiRegionEndpoints			List
ListRecommendations	ses:ListRecommendations			Read
ListReputationEntities	ses:ListReputationEntities			List
ListResourceTenants	ses:ListResourceTenants			List
ListSuppressedDestinations	ses:ListSuppressedDestinations			Read
ListTagsForResource	ses:ListTagsForResource			Read
ListTenantResources	ses:ListTenantResources			List
ListTenants	ses:ListTenants			List
PutAccountDedicatedIpWarmupAttributes	ses:PutAccountDedicatedIpWarmupAttributes			Write
PutAccountDetails	ses:PutAccountDetails			Write
PutAccountSendingAttributes	ses:PutAccountSendingAttributes			Write
PutAccountSuppressionAttributes	ses:PutAccountSuppressionAttributes			Write
PutAccountVdmAttributes	ses:PutAccountVdmAttributes			Write
PutConfigurationSetArchivingOptions	ses:PutConfigurationSetArchivingOptions			Write
PutConfigurationSetDeliveryOptions	ses:PutConfigurationSetDeliveryOptions			Write
PutConfigurationSetReputationOptions	ses:PutConfigurationSetReputationOptions			Write
PutConfigurationSetSendingOptions	ses:PutConfigurationSetSendingOptions			Write
PutConfigurationSetSuppressionOptions	ses:PutConfigurationSetSuppressionOptions			Write
PutConfigurationSetTrackingOptions	ses:PutConfigurationSetTrackingOptions			Write
PutConfigurationSetVdmOptions	ses:PutConfigurationSetVdmOptions			Write
PutDedicatedIpInPool	ses:PutDedicatedIpInPool			Write
PutDedicatedIpPoolScalingAttributes	ses:PutDedicatedIpPoolScalingAttributes			Write
PutDedicatedIpWarmupAttributes	ses:PutDedicatedIpWarmupAttributes			Write
PutDeliverabilityDashboardOption	ses:PutDeliverabilityDashboardOption			Write
PutEmailIdentityConfigurationSetAttributes	ses:PutEmailIdentityConfigurationSetAttributes			Write
PutEmailIdentityDkimAttributes	ses:PutEmailIdentityDkimAttributes			Write
PutEmailIdentityDkimSigningAttributes	ses:PutEmailIdentityDkimSigningAttributes			Write
PutEmailIdentityFeedbackAttributes	ses:PutEmailIdentityFeedbackAttributes			Write
PutEmailIdentityMailFromAttributes	ses:PutEmailIdentityMailFromAttributes			Write
PutSuppressedDestination	ses:PutSuppressedDestination			Write
PutTenantSuppressionAttributes	ses:PutTenantSuppressionAttributes			Write
SendBulkEmail	ses:SendBulkEmail			Write
SendCustomVerificationEmail	ses:SendCustomVerificationEmail			Write
TagResource	ses:TagResource			Tagging, Write
TestRenderEmailTemplate	ses:TestRenderEmailTemplate			Write
UntagResource	ses:UntagResource			Tagging, Write
UpdateConfigurationSetEventDestination	ses:UpdateConfigurationSetEventDestination			Write
UpdateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
UpdateContact	ses:UpdateContact			Write
UpdateContactList	ses:UpdateContactList			Write
UpdateCustomVerificationEmailTemplate	ses:UpdateCustomVerificationEmailTemplate			Write
UpdateEmailIdentityPolicy	ses:UpdateEmailIdentityPolicy			Permissions management, Write
UpdateEmailTemplate	ses:UpdateEmailTemplate			Write
UpdateReputationEntityCustomerManagedStatus	ses:UpdateReputationEntityCustomerManagedStatus			Write
UpdateReputationEntityPolicy	ses:UpdateReputationEntityPolicy			Write

Actions defined by Amazon Simple Email Service v2

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetMetricData	Grants permission to get metric data on your activity	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
BatchGetMetricData	Grants permission to get metric data on your activity	identity	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
CancelExportJob	Grants permission to cancel an export job	export-job*	ses:ApiVersion ses:ExportSourceType	Write
CreateConfigurationSet	Grants permission to create a new configuration set	configuration-set*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
		dedicated-ip-pool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		mailmanager-archive	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
CreateConfigurationSetEventDestination	Grants permission to create a configuration set event destination	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
CreateContact	Grants permission to create a contact	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
CreateContactList	Grants permission to create a contact list	contact-list*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateCustomVerificationEmailTemplate	Grants permission to create a new custom verification email template	custom-verification-email-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateDedicatedIpPool	Grants permission to create a new pool of dedicated IP addresses	dedicated-ip-pool*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateDeliverabilityTestReport	Grants permission to create a new predictive inbox placement test	identity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateEmailIdentity	Grants permission to start the process of verifying an email identity	identity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateEmailIdentityPolicy	Grants permission to create the specified sending authorization policy for the given identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Permissions management, Write
CreateEmailTemplate	Grants permission to create an email template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateExportJob	Grants permission to create an export job		ses:ApiVersion ses:ExportSourceType	Write
CreateImportJob	Grants permission to creates an import job for a data destination		ses:ApiVersion	Write
CreateMultiRegionEndpoint	Grants permission to create a new multi-region endpoint		aws:RequestTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateTenant	Grants permission to create a new tenant	tenant*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateTenantResourceAssociation	Grants permission to associate a SES resource to a tenant	configuration-set*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
		identity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		tenant*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
DeleteConfigurationSet	Grants permission to delete an existing configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteContact	Grants permission to delete a contact from a contact list	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteContactList	Grants permission to delete a contact list with all of its contacts	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteCustomVerificationEmailTemplate	Grants permission to delete an existing custom verification email template	custom-verification-email-template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteEmailIdentity	Grants permission to delete an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteEmailIdentityPolicy	Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Permissions management, Write
DeleteEmailTemplate	Grants permission to delete an email template	template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteMultiRegionEndpoint	Grants permission to delete a multi-region endpoint	multi-region-endpoint*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteSuppressedDestination	Grants permission to remove an email address from the suppression list for your account or tenant	tenant	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteTenant	Grants permission to delete a tenant	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteTenantResourceAssociation	Grants permission to remove an associated SES resource from a tenant	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
		identity*	aws:ResourceTag/${TagKey} ses:ApiVersion
		template*	aws:ResourceTag/${TagKey} ses:ApiVersion
		tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion
GetAccount	Grants permission to get information about the email-sending status and capabilities for your account		ses:ApiVersion	Read
GetBlacklistReports	Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses or tracked domains appear		ses:ApiVersion	Read
GetConfigurationSet	Grants permission to get information about an existing configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetConfigurationSetEventDestinations	Grants permission to retrieve a list of event destinations that are associated with a configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetContact	Grants permission to return a contact from a contact list	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetContactList	Grants permission to return contact list metadata	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetCustomVerificationEmailTemplate	Grants permission to return the custom email verification template for the template name you specify	custom-verification-email-template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDedicatedIp	Grants permission to get information about a dedicated IP address		ses:ApiVersion	Read
GetDedicatedIpPool	Grants permission to get information about a dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDedicatedIps	Grants permission to list the dedicated IP addresses a dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDeliverabilityDashboardOptions	Grants permission to get the status of the Deliverability dashboard		ses:ApiVersion	Read
GetDeliverabilityTestReport	Grants permission to retrieve the results of a predictive inbox placement test	deliverability-test-report*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDomainDeliverabilityCampaign	Grants permission to retrieve all the deliverability data for a specific campaign		ses:ApiVersion	Read
GetDomainStatisticsReport	Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetEmailAddressInsights	Grants permission to get insights about email address		ses:ApiVersion	Read
GetEmailIdentity	Grants permission to get information about a specific identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetEmailIdentityPolicies	Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetEmailTemplate	Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify	template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetExportJob	Grants permission to get information about an export job	export-job*	ses:ApiVersion ses:ExportSourceType	Read
GetImportJob	Grants permission to provide information about an import job	import-job*	ses:ApiVersion	Read
GetMessageInsights	Grants permission to provide insights about a message		ses:ApiVersion	Read
GetMultiRegionEndpoint	Grants permission to get information about a multi-region endpoint	multi-region-endpoint*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetReputationEntity	Grants permission to retrieve information about a reputation entity's status	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetSuppressedDestination	Grants permission to retrieve information about a specific email address that's on the suppression list for your account or tenant	tenant	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetTenant	Grants permission to get information about a tenant	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
ListConfigurationSets	Grants permission to list all of the configuration sets for your account		ses:ApiVersion	List
ListContactLists	Grants permission to list all of the contact lists available for your account		ses:ApiVersion	List
ListContacts	Grants permission to list the contacts present in a specific contact list	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	List
ListCustomVerificationEmailTemplates	Grants permission to list all of the existing custom verification email templates for your account		ses:ApiVersion	List
ListDedicatedIpPools	Grants permission to list all of the dedicated IP pools for your account		ses:ApiVersion	List
ListDeliverabilityTestReports	Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account		ses:ApiVersion	List
ListDomainDeliverabilityCampaigns	Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range		ses:ApiVersion	Read
ListEmailIdentities	Grants permission to list the email identities for your account		ses:ApiVersion	List
ListEmailTemplates	Grants permission to list all of the email templates for your account		ses:ApiVersion	List
ListExportJobs	Grants permission to list all the exports jobs for your account		ses:ApiVersion ses:ExportSourceType	List
ListImportJobs	Grants permission to list all of the import jobs for your account		ses:ApiVersion	List
ListMultiRegionEndpoints	Grants permission to list all of the multi-region endpoints for your account		ses:ApiVersion	List
ListRecommendations	Grants permission to list recommendations for your account	identity	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
ListReputationEntities	Grants permission to retrieve a list of reputation entities	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	List
ListResourceTenants	Grants permission to list all the tenants associated to a SES resource	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	List
		identity*	aws:ResourceTag/${TagKey} ses:ApiVersion
		template*	aws:ResourceTag/${TagKey} ses:ApiVersion
ListSuppressedDestinations	Grants permission to list email addresses that are on the suppression list for your account or tenant	tenant	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
ListTagsForResource	Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
		contact-list	aws:ResourceTag/${TagKey} ses:ApiVersion
		custom-verification-email-template	aws:ResourceTag/${TagKey} ses:ApiVersion
		dedicated-ip-pool	aws:ResourceTag/${TagKey} ses:ApiVersion
		deliverability-test-report	aws:ResourceTag/${TagKey} ses:ApiVersion
		identity	aws:ResourceTag/${TagKey} ses:ApiVersion
		mailmanager-archive	aws:ResourceTag/${TagKey} ses:ApiVersion
		template	aws:ResourceTag/${TagKey} ses:ApiVersion
		tenant	aws:ResourceTag/${TagKey} ses:ApiVersion
ListTenantResources	Grants permission to list all the resources associated to a tenant	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	List
ListTenants	Grants permission to list all the tenants for your account		ses:ApiVersion	List
PutAccountDedicatedIpWarmupAttributes	Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses		ses:ApiVersion	Write
PutAccountDetails	Grants permission to update your account details		ses:ApiVersion	Write
PutAccountSendingAttributes	Grants permission to enable or disable the ability to send email for your account		ses:ApiVersion	Write
PutAccountSuppressionAttributes	Grants permission to change the settings for the account-level suppression list		ses:ApiVersion	Write
PutAccountVdmAttributes	Grants permission to change the settings for VDM for your account		ses:ApiVersion	Write
PutConfigurationSetArchivingOptions	Grants permission to associate a configuration set with a Mail Manager archive	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetArchivingOptions		mailmanager-archive	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetDeliveryOptions	Grants permission to associate a configuration set with a dedicated IP pool	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetDeliveryOptions		dedicated-ip-pool	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetReputationOptions	Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetSendingOptions	Grants permission to enable or disable email sending for messages that use a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetSuppressionOptions	Grants permission to specify the account suppression list preferences for a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetTrackingOptions	Grants permission to specify a custom domain to use for open and click tracking elements in email that you send for a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetVdmOptions	Grants permission to override account-level VDM settings for a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutDedicatedIpInPool	Grants permission to move a dedicated IP address to an existing dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutDedicatedIpPoolScalingAttributes	Grants permission to transition a dedicated IP pool from Standard to Managed	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutDedicatedIpWarmupAttributes	Grants permission to put Dedicated IP warm up attributes		ses:ApiVersion	Write
PutDeliverabilityDashboardOption	Grants permission to enable or disable the Deliverability dashboard		ses:ApiVersion	Write
PutEmailIdentityConfigurationSetAttributes	Grants permission to associate a configuration set with an email identity	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityConfigurationSetAttributes		identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityDkimAttributes	Grants permission to enable or disable DKIM authentication for an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityDkimSigningAttributes	Grants permission to configure or change the DKIM authentication settings for an email domain identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityFeedbackAttributes	Grants permission to enable or disable feedback forwarding for an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityMailFromAttributes	Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutSuppressedDestination	Grants permission to add an email address to the suppression list for your account or tenant	tenant	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutTenantSuppressionAttributes	Grants permission to change the settings for the tenant-level suppression list	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
SendBulkEmail	Grants permission to compose an email message to multiple destinations	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion ses:MultiRegionEndpointId ses:TenantName	Write
		identity*	aws:ResourceTag/${TagKey} ses:ApiVersion ses:MultiRegionEndpointId ses:TenantName
		template*	aws:ResourceTag/${TagKey} ses:ApiVersion ses:MultiRegionEndpointId ses:TenantName
SendCustomVerificationEmail	Grants permission to add an email address to the list of identities and attempts to verify it	custom-verification-email-template*	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendCustomVerificationEmail		identity	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendEmail	Grants permission to send an email message	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:MultiRegionEndpointId ses:Recipients ses:TenantName	Write
		identity*	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:MultiRegionEndpointId ses:Recipients ses:TenantName
		template	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:MultiRegionEndpointId ses:Recipients ses:TenantName
TagResource	Grants permission to add one or more tags (keys and values) to a specified resource	configuration-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Tagging, Write
		contact-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		custom-verification-email-template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		dedicated-ip-pool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		deliverability-test-report	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		identity	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		mailmanager-archive	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		tenant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
TestRenderEmailTemplate	Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data	template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UntagResource	Grants permission to remove one or more tags (keys and values) from a specified resource	configuration-set	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Tagging, Write
		contact-list	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		custom-verification-email-template	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		dedicated-ip-pool	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		deliverability-test-report	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		identity	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		mailmanager-archive	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		template	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		tenant	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
UpdateConfigurationSetEventDestination	Grants permission to update the configuration of an event destination for a configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateContact	Grants permission to update a contact's preferences for a list	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateContactList	Grants permission to update contact list metadata	contact-list*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateCustomVerificationEmailTemplate	Grants permission to update an existing custom verification email template	custom-verification-email-template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateEmailIdentityPolicy	Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain)	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Permissions management, Write
UpdateEmailTemplate	Grants permission to update an email template	template*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateReputationEntityCustomerManagedStatus	Grants permission to update the customer-managed sending status	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateReputationEntityPolicy	Grants permission to assign a reputation policy	reputation-policy*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
UpdateReputationEntityPolicy	Grants permission to assign a reputation policy	tenant*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write

Permission-only actions for Amazon Simple Email Service v2

The following actions are defined by Amazon Simple Email Service v2 but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ReplicateEmailIdentityDkimSigningKey	Grants permission to replicate email identity DKIM signing key	identity*	aws:ResourceTag/${TagKey} ses:ReplicaRegion	Permissions management, Write

Actions

Description

Resource types (*required)

Condition keys

Access level

ReplicateEmailIdentityDkimSigningKey

Grants permission to replicate email identity DKIM signing key

identity*

aws:ResourceTag/${TagKey}

ses:ReplicaRegion

Permissions management, Write

Resource types defined by Amazon Simple Email Service v2

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
configuration-set	arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}	aws:ResourceTag/${TagKey}
contact-list	arn:${Partition}:ses:${Region}:${Account}:contact-list/${ContactListName}	aws:ResourceTag/${TagKey}
custom-verification-email-template	arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${TemplateName}	aws:ResourceTag/${TagKey}
dedicated-ip-pool	arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${DedicatedIPPool}	aws:ResourceTag/${TagKey}
deliverability-test-report	arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${ReportId}	aws:ResourceTag/${TagKey}
export-job	arn:${Partition}:ses:${Region}:${Account}:export-job/${ExportJobId}
identity	arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}	aws:ResourceTag/${TagKey}
import-job	arn:${Partition}:ses:${Region}:${Account}:import-job/${ImportJobId}
mailmanager-archive	arn:${Partition}:ses:${Region}:${Account}:mailmanager-archive/${ArchiveId}	aws:ResourceTag/${TagKey}
multi-region-endpoint	arn:${Partition}:ses:${Region}:${Account}:multi-region-endpoint/${EndpointName}
reputation-policy	arn:${Partition}:ses:${Region}:aws:reputation-policy/${ReputationPolicyName}
template	arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}	aws:ResourceTag/${TagKey}
tenant	arn:${Partition}:ses:${Region}:${Account}:tenant/${TenantName}/${TenantId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Simple Email Service v2

Amazon Simple Email Service v2 defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
ses:ApiVersion	Filters access by the SES API version	String
ses:ExportSourceType	Filters access by the export source type	String
ses:FeedbackAddress	Filters access by the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding	String
ses:FromAddress	Filters access by the "From" address of a message	String
ses:FromDisplayName	Filters access by the "From" address that is used as the display name of a message	String
ses:MultiRegionEndpointId	Filters access by the multi-region endpoint ID that is used to send email	String
ses:Recipients	Filters access by the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses	ArrayOfString
ses:ReplicaRegion	Filters access by the replica regions for Replicating domain DKIM signing key	ArrayOfString
ses:TenantName	Filters access by the tenant name that is used to send email	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Simple Email Service - Mail Manager (ses)

Amazon Simple Workflow Service (swf)