Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Pinpoint Email Service

Amazon Pinpoint Email Service (service prefix: ses) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Pinpoint Email Service
Actions defined by Amazon Pinpoint Email Service
Resource types defined by Amazon Pinpoint Email Service
Condition keys for Amazon Pinpoint Email Service

API operations defined by Amazon Pinpoint Email Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateConfigurationSet	ses:CreateConfigurationSet			Write
CreateConfigurationSet	ses:TagResource			Tagging, Write
CreateConfigurationSetEventDestination	ses:CreateConfigurationSetEventDestination			Write
CreateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
CreateDedicatedIpPool	ses:CreateDedicatedIpPool			Write
CreateDedicatedIpPool	ses:TagResource			Tagging, Write
CreateDeliverabilityTestReport	ses:CreateDeliverabilityTestReport			Write
CreateDeliverabilityTestReport	ses:TagResource			Tagging, Write
CreateEmailIdentity	ses:CreateEmailIdentity			Write
CreateEmailIdentity	ses:TagResource			Tagging, Write
DeleteConfigurationSet	ses:DeleteConfigurationSet			Write
DeleteConfigurationSetEventDestination	ses:DeleteConfigurationSetEventDestination			Write
DeleteDedicatedIpPool	ses:DeleteDedicatedIpPool			Write
DeleteEmailIdentity	ses:DeleteEmailIdentity			Write
GetAccount	ses:GetAccount			Read
GetBlacklistReports	ses:GetBlacklistReports			Read
GetConfigurationSet	ses:GetConfigurationSet			Read
GetConfigurationSetEventDestinations	ses:GetConfigurationSetEventDestinations			Read
GetDedicatedIp	ses:GetDedicatedIp			Read
GetDedicatedIps	ses:GetDedicatedIps			Read
GetDeliverabilityDashboardOptions	ses:GetDeliverabilityDashboardOptions			Read
GetDeliverabilityTestReport	ses:GetDeliverabilityTestReport			Read
GetDomainDeliverabilityCampaign	ses:GetDomainDeliverabilityCampaign			Read
GetDomainStatisticsReport	ses:GetDomainStatisticsReport			Read
GetEmailIdentity	ses:GetEmailIdentity			Read
ListConfigurationSets	ses:ListConfigurationSets			List
ListDedicatedIpPools	ses:ListDedicatedIpPools			List
ListDeliverabilityTestReports	ses:ListDeliverabilityTestReports			List
ListDomainDeliverabilityCampaigns	ses:ListDomainDeliverabilityCampaigns			Read
ListEmailIdentities	ses:ListEmailIdentities			List
ListTagsForResource	ses:ListTagsForResource			Read
PutAccountDedicatedIpWarmupAttributes	ses:PutAccountDedicatedIpWarmupAttributes			Write
PutAccountSendingAttributes	ses:PutAccountSendingAttributes			Write
PutConfigurationSetDeliveryOptions	ses:PutConfigurationSetDeliveryOptions			Write
PutConfigurationSetReputationOptions	ses:PutConfigurationSetReputationOptions			Write
PutConfigurationSetSendingOptions	ses:PutConfigurationSetSendingOptions			Write
PutConfigurationSetTrackingOptions	ses:PutConfigurationSetTrackingOptions			Write
PutDedicatedIpInPool	ses:PutDedicatedIpInPool			Write
PutDedicatedIpWarmupAttributes	ses:PutDedicatedIpWarmupAttributes			Write
PutDeliverabilityDashboardOption	ses:PutDeliverabilityDashboardOption			Write
PutEmailIdentityDkimAttributes	ses:PutEmailIdentityDkimAttributes			Write
PutEmailIdentityFeedbackAttributes	ses:PutEmailIdentityFeedbackAttributes			Write
PutEmailIdentityMailFromAttributes	ses:PutEmailIdentityMailFromAttributes			Write
TagResource	ses:TagResource			Tagging, Write
UntagResource	ses:UntagResource			Tagging, Write
UpdateConfigurationSetEventDestination	ses:UpdateConfigurationSetEventDestination			Write
UpdateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write

Actions defined by Amazon Pinpoint Email Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateConfigurationSet	Grants permission to create a configuration set	configuration-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateConfigurationSet	Grants permission to create a configuration set	dedicated-ip-pool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateConfigurationSetEventDestination	Grants permission to create a configuration set event destination	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
CreateDedicatedIpPool	Grants permission to create a new pool of dedicated IP addresses	dedicated-ip-pool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateDeliverabilityTestReport	Grants permission to create a new predictive inbox placement test	identity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
CreateEmailIdentity	Grants permission to start the process of verifying an email identity	identity	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Write
DeleteConfigurationSet	Grants permission to delete an existing configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
DeleteEmailIdentity	Grants permission to delete an email identity that you previously verified	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
GetAccount	Grants permission to get information about the email-sending status and capabilities		ses:ApiVersion	Read
GetBlacklistReports	Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses appear		ses:ApiVersion	Read
GetConfigurationSet	Grants permission to get information about an existing configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetConfigurationSetEventDestinations	Grants permission to retrieve a list of event destinations that are associated with a configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDedicatedIp	Grants permission to get information about a dedicated IP address		ses:ApiVersion	Read
GetDedicatedIps	Grants permission to list the dedicated IP addresses that are associated with your account	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDeliverabilityDashboardOptions	Grants permission to get the status of the Deliverability dashboard		ses:ApiVersion	Read
GetDeliverabilityTestReport	Grants permission to retrieve the results of a predictive inbox placement test	deliverability-test-report*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetDomainDeliverabilityCampaign	Grants permission to retrieve all the deliverability data for a specific campaign		ses:ApiVersion	Read
GetDomainStatisticsReport	Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
GetEmailIdentity	Grants permission to get information about a specific identity associated with your account	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
ListConfigurationSets	Grants permission to list all of the configuration sets associated with your account		ses:ApiVersion	List
ListDedicatedIpPools	Grants permission to list all of the dedicated IP pools that exist in your account		ses:ApiVersion	List
ListDeliverabilityTestReports	Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses		ses:ApiVersion	List
ListDomainDeliverabilityCampaigns	Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range		ses:ApiVersion	Read
ListEmailIdentities	Grants permission to list all of the email identities that are associated with your account		ses:ApiVersion	List
ListTagsForResource	Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion	Read
		dedicated-ip-pool	aws:ResourceTag/${TagKey} ses:ApiVersion
		deliverability-test-report	aws:ResourceTag/${TagKey} ses:ApiVersion
		identity	aws:ResourceTag/${TagKey} ses:ApiVersion
PutAccountDedicatedIpWarmupAttributes	Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses		ses:ApiVersion	Write
PutAccountSendingAttributes	Grants permission to enable or disable the ability of your account to send email		ses:ApiVersion	Write
PutConfigurationSetDeliveryOptions	Grants permission to associate a configuration set with a dedicated IP pool	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetDeliveryOptions		dedicated-ip-pool	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetReputationOptions	Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetSendingOptions	Grants permission to enable or disable email sending for messages that use a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutConfigurationSetTrackingOptions	Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutDedicatedIpInPool	Grants permission to move a dedicated IP address to an existing dedicated IP pool	dedicated-ip-pool*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutDedicatedIpWarmupAttributes	Grants permission to enable dedicated IP warm up attributes		ses:ApiVersion	Write
PutDeliverabilityDashboardOption	Grants permission to enable or disable the Deliverability dashboard		ses:ApiVersion	Write
PutEmailIdentityDkimAttributes	Grants permission to enable or disable DKIM authentication for an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityFeedbackAttributes	Grants permission to enable or disable feedback forwarding for an identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
PutEmailIdentityMailFromAttributes	Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write
SendEmail	Grants permission to send an email message	configuration-set	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendEmail	Grants permission to send an email message	identity*	aws:ResourceTag/${TagKey} ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
TagResource	Grants permission to add one or more tags (keys and values) to a specified resource	configuration-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Tagging, Write
		dedicated-ip-pool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		deliverability-test-report	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		identity	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
UntagResource	Grants permission to remove one or more tags (keys and values) from a specified resource	configuration-set	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion	Tagging, Write
		dedicated-ip-pool	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		deliverability-test-report	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
		identity	aws:ResourceTag/${TagKey} aws:TagKeys ses:ApiVersion
UpdateConfigurationSetEventDestination	Grants permission to update the configuration of an event destination for a configuration set	configuration-set*	aws:ResourceTag/${TagKey} ses:ApiVersion	Write

Resource types defined by Amazon Pinpoint Email Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
configuration-set	arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}	aws:ResourceTag/${TagKey}
dedicated-ip-pool	arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${DedicatedIPPool}	aws:ResourceTag/${TagKey}
deliverability-test-report	arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${ReportId}	aws:ResourceTag/${TagKey}
identity	arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Pinpoint Email Service

Amazon Pinpoint Email Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString
ses:ApiVersion	Filters actions based on the SES API version	String
ses:FeedbackAddress	Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding	String
ses:FromAddress	Filters actions based on the "From" address of a message	String
ses:FromDisplayName	Filters actions based on the "From" address that is used as the display name of a message	String
ses:Recipients	Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Pinpoint (mobiletargeting)

Amazon Pinpoint SMS and Voice Service (sms-voice)