Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon SES

Amazon SES (service prefix: ses) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon SES

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CloneReceiptRuleSet	ses:CloneReceiptRuleSet			Write
CreateConfigurationSet	ses:CreateConfigurationSet			Write
CreateConfigurationSet	ses:TagResource			Tagging, Write
CreateConfigurationSetEventDestination	ses:CreateConfigurationSetEventDestination			Write
CreateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
CreateConfigurationSetTrackingOptions	ses:CreateConfigurationSetTrackingOptions			Write
CreateCustomVerificationEmailTemplate	ses:CreateCustomVerificationEmailTemplate			Write
CreateCustomVerificationEmailTemplate	ses:TagResource			Tagging, Write
CreateReceiptFilter	ses:CreateReceiptFilter			Write
CreateReceiptRule	ses:CreateReceiptRule			Write
CreateReceiptRule	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
CreateReceiptRuleSet	ses:CreateReceiptRuleSet			Write
CreateTemplate	ses:CreateTemplate			Write
DeleteConfigurationSet	ses:DeleteConfigurationSet			Write
DeleteConfigurationSetEventDestination	ses:DeleteConfigurationSetEventDestination			Write
DeleteConfigurationSetTrackingOptions	ses:DeleteConfigurationSetTrackingOptions			Write
DeleteCustomVerificationEmailTemplate	ses:DeleteCustomVerificationEmailTemplate			Write
DeleteIdentity	ses:DeleteIdentity			Write
DeleteIdentityPolicy	ses:DeleteIdentityPolicy			Permissions management, Write
DeleteReceiptFilter	ses:DeleteReceiptFilter			Write
DeleteReceiptRule	ses:DeleteReceiptRule			Write
DeleteReceiptRuleSet	ses:DeleteReceiptRuleSet			Write
DeleteTemplate	ses:DeleteTemplate			Write
DeleteVerifiedEmailAddress	ses:DeleteVerifiedEmailAddress			Write
DescribeActiveReceiptRuleSet	ses:DescribeActiveReceiptRuleSet			Read
DescribeConfigurationSet	ses:DescribeConfigurationSet			Read
DescribeReceiptRule	ses:DescribeReceiptRule			Read
DescribeReceiptRuleSet	ses:DescribeReceiptRuleSet			Read
GetAccountSendingEnabled	ses:GetAccountSendingEnabled			Read
GetCustomVerificationEmailTemplate	ses:GetCustomVerificationEmailTemplate			Read
GetIdentityDkimAttributes	ses:GetIdentityDkimAttributes			Read
GetIdentityMailFromDomainAttributes	ses:GetIdentityMailFromDomainAttributes			Read
GetIdentityNotificationAttributes	ses:GetIdentityNotificationAttributes			Read
GetIdentityPolicies	ses:GetIdentityPolicies			Read
GetIdentityVerificationAttributes	ses:GetIdentityVerificationAttributes			Read
GetSendQuota	ses:GetSendQuota			Read
GetSendStatistics	ses:GetSendStatistics			Read
GetTemplate	ses:GetTemplate			Read
ListConfigurationSets	ses:ListConfigurationSets			List
ListCustomVerificationEmailTemplates	ses:ListCustomVerificationEmailTemplates			List
ListIdentities	ses:ListIdentities			List
ListIdentityPolicies	ses:ListIdentityPolicies			List
ListReceiptFilters	ses:ListReceiptFilters			Read
ListReceiptRuleSets	ses:ListReceiptRuleSets			Read
ListTemplates	ses:ListTemplates			List
ListVerifiedEmailAddresses	ses:ListVerifiedEmailAddresses			Read
PutConfigurationSetDeliveryOptions	ses:PutConfigurationSetDeliveryOptions			Write
PutIdentityPolicy	ses:PutIdentityPolicy			Permissions management, Write
ReorderReceiptRuleSet	ses:ReorderReceiptRuleSet			Write
SendCustomVerificationEmail	ses:SendCustomVerificationEmail			Write
SetActiveReceiptRuleSet	ses:SetActiveReceiptRuleSet			Write
SetIdentityDkimEnabled	ses:SetIdentityDkimEnabled			Write
SetIdentityFeedbackForwardingEnabled	ses:SetIdentityFeedbackForwardingEnabled			Write
SetIdentityHeadersInNotificationsEnabled	ses:SetIdentityHeadersInNotificationsEnabled			Write
SetIdentityMailFromDomain	ses:SetIdentityMailFromDomain			Write
SetIdentityNotificationTopic	ses:SetIdentityNotificationTopic			Write
SetReceiptRulePosition	ses:SetReceiptRulePosition			Write
TestRenderTemplate	ses:TestRenderTemplate			Write
UpdateAccountSendingEnabled	ses:UpdateAccountSendingEnabled			Write
UpdateConfigurationSetEventDestination	ses:UpdateConfigurationSetEventDestination			Write
UpdateConfigurationSetEventDestination	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
UpdateConfigurationSetReputationMetricsEnabled	ses:UpdateConfigurationSetReputationMetricsEnabled			Write
UpdateConfigurationSetSendingEnabled	ses:UpdateConfigurationSetSendingEnabled			Write
UpdateConfigurationSetTrackingOptions	ses:UpdateConfigurationSetTrackingOptions			Write
UpdateCustomVerificationEmailTemplate	ses:UpdateCustomVerificationEmailTemplate			Write
UpdateReceiptRule	ses:UpdateReceiptRule			Write
UpdateReceiptRule	iam:PassRole	iam:PassedToService	ses.amazonaws.com	Write
UpdateTemplate	ses:UpdateTemplate			Write
VerifyDomainDkim	ses:VerifyDomainDkim			Write
VerifyDomainIdentity	ses:VerifyDomainIdentity			Write
VerifyEmailAddress	ses:VerifyEmailAddress			Write
VerifyEmailIdentity	ses:VerifyEmailIdentity			Write

Actions defined by Amazon SES

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CloneReceiptRuleSet	Grants permission to create a receipt rule set by cloning an existing one		ses:ApiVersion	Write
CreateConfigurationSet	Grants permission to create a new configuration set	configuration-set	ses:ApiVersion	Write
CreateConfigurationSetEventDestination	Grants permission to create a configuration set event destination	configuration-set	ses:ApiVersion	Write
CreateConfigurationSetTrackingOptions	Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking		ses:ApiVersion	Write
CreateCustomVerificationEmailTemplate	Grants permission to create a new custom verification email template	custom-verification-email-template	ses:ApiVersion	Write
CreateReceiptFilter	Grants permission to create a new IP address filter		ses:ApiVersion	Write
CreateReceiptRule	Grants permission to create a receipt rule		ses:ApiVersion	Write
CreateReceiptRuleSet	Grants permission to create an empty receipt rule set		ses:ApiVersion	Write
CreateTemplate	Grants permission to creates an email template		ses:ApiVersion	Write
DeleteConfigurationSet	Grants permission to delete an existing configuration set	configuration-set	ses:ApiVersion	Write
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	configuration-set	ses:ApiVersion	Write
DeleteConfigurationSetTrackingOptions	Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking		ses:ApiVersion	Write
DeleteCustomVerificationEmailTemplate	Grants permission to delete an existing custom verification email template	custom-verification-email-template	ses:ApiVersion	Write
DeleteIdentity	Grants permission to delete the specified identity		ses:ApiVersion	Write
DeleteIdentityPolicy	Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)		ses:ApiVersion	Permissions management, Write
DeleteReceiptFilter	Grants permission to delete the specified IP address filter		ses:ApiVersion	Write
DeleteReceiptRule	Grants permission to delete the specified receipt rule		ses:ApiVersion	Write
DeleteReceiptRuleSet	Grants permission to delete the specified receipt rule set and all of the receipt rules it contains		ses:ApiVersion	Write
DeleteTemplate	Grants permission to delete an email template		ses:ApiVersion	Write
DeleteVerifiedEmailAddress	Grants permission to delete the specified email address from the list of verified addresses		ses:ApiVersion	Write
DescribeActiveReceiptRuleSet	Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active		ses:ApiVersion	Read
DescribeConfigurationSet	Grants permission to return the details of the specified configuration set		ses:ApiVersion	Read
DescribeReceiptRule	Grants permission to return the details of the specified receipt rule		ses:ApiVersion	Read
DescribeReceiptRuleSet	Grants permission to return the details of the specified receipt rule set		ses:ApiVersion	Read
GetAccountSendingEnabled	Grants permission to return the email sending status of your account		ses:ApiVersion	Read
GetCustomVerificationEmailTemplate	Grants permission to return the custom email verification template for the template name you specify	custom-verification-email-template	ses:ApiVersion	Read
GetIdentityDkimAttributes	Grants permission to return the current status of Easy DKIM signing for an entity		ses:ApiVersion	Read
GetIdentityMailFromDomainAttributes	Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains)		ses:ApiVersion	Read
GetIdentityNotificationAttributes	Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),		ses:ApiVersion	Read
GetIdentityPolicies	Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)		ses:ApiVersion	Read
GetIdentityVerificationAttributes	Grants permission to return the verification status and (for domain identities) the verification token for a list of identities		ses:ApiVersion	Read
GetSendQuota	Grants permission to return the user's current sending limits		ses:ApiVersion	Read
GetSendStatistics	Grants permission to returns the user's sending statistics		ses:ApiVersion	Read
GetTemplate	Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify		ses:ApiVersion	Read
ListConfigurationSets	Grants permission to list all of the configuration sets for your account		ses:ApiVersion	List
ListCustomVerificationEmailTemplates	Grants permission to list all of the existing custom verification email templates for your account		ses:ApiVersion	List
ListIdentities	Grants permission to list the email identities for your account		ses:ApiVersion	List
ListIdentityPolicies	Grants permission to list all of the email templates for your account		ses:ApiVersion	List
ListReceiptFilters	Grants permission to list the IP address filters associated with your account		ses:ApiVersion	Read
ListReceiptRuleSets	Grants permission to list the receipt rule sets that exist under your account		ses:ApiVersion	Read
ListTemplates	Grants permission to list the email templates present in your account		ses:ApiVersion	List
ListVerifiedEmailAddresses	Grants permission to list all of the email addresses that have been verified in your account		ses:ApiVersion	Read
PutConfigurationSetDeliveryOptions	Grants permission to add or update the delivery options for a configuration set	configuration-set	ses:ApiVersion	Write
PutIdentityPolicy	Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain)		ses:ApiVersion	Permissions management, Write
ReorderReceiptRuleSet	Grants permission to reorder the receipt rules within a receipt rule set		ses:ApiVersion	Write
SendBounce	Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES	identity*	ses:ApiVersion ses:FromAddress	Write
SendBulkTemplatedEmail	Grants permission to compose an email message to multiple destinations	configuration-set	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
		identity*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
		template*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
SendCustomVerificationEmail	Grants permission to add an email address to the list of identities and attempts to verify it for your account	custom-verification-email-template	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendCustomVerificationEmail		identity*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendEmail	Grants permission to send an email message	configuration-set	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
		identity*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
		template	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
SendRawEmail	Grants permission to send an email message, with header and content specified by the client	configuration-set	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendRawEmail		identity*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
SendTemplatedEmail	Grants permission to compose an email message using an email template	configuration-set	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients	Write
		identity*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
		template*	ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
SetActiveReceiptRuleSet	Grants permission to set the specified receipt rule set as the active receipt rule set		ses:ApiVersion	Write
SetIdentityDkimEnabled	Grants permission to enable or disable Easy DKIM signing of email sent from an identity		ses:ApiVersion	Write
SetIdentityFeedbackForwardingEnabled	Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain)		ses:ApiVersion	Write
SetIdentityHeadersInNotificationsEnabled	Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain)		ses:ApiVersion	Write
SetIdentityMailFromDomain	Grants permission to enable or disable the custom MAIL FROM domain setup for a verified identity		ses:ApiVersion	Write
SetIdentityNotificationTopic	Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity		ses:ApiVersion	Write
SetReceiptRulePosition	Grants permission to set the position of the specified receipt rule in the receipt rule set		ses:ApiVersion	Write
TestRenderTemplate	Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data		ses:ApiVersion	Write
UpdateAccountSendingEnabled	Grants permission to enable or disable email sending for your account		ses:ApiVersion	Write
UpdateConfigurationSetEventDestination	Grants permission to update the event destination of a configuration set	configuration-set	ses:ApiVersion	Write
UpdateConfigurationSetReputationMetricsEnabled	Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set		ses:ApiVersion	Write
UpdateConfigurationSetSendingEnabled	Grants permission to enable or disable email sending for messages sent using a specific configuration set		ses:ApiVersion	Write
UpdateConfigurationSetTrackingOptions	Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking		ses:ApiVersion	Write
UpdateCustomVerificationEmailTemplate	Grants permission to update an existing custom verification email template	custom-verification-email-template	ses:ApiVersion	Write
UpdateReceiptRule	Grants permission to update a receipt rule		ses:ApiVersion	Write
UpdateTemplate	Grants permission to update an email template		ses:ApiVersion	Write
VerifyDomainDkim	Grants permission to return a set of DKIM tokens for a domain		ses:ApiVersion	Write
VerifyDomainIdentity	Grants permission to verify a domain		ses:ApiVersion	Write
VerifyEmailAddress	Grants permission to verify an email address		ses:ApiVersion	Write
VerifyEmailIdentity	Grants permission to verify an email identity		ses:ApiVersion	Write

Resource types defined by Amazon SES

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
configuration-set	arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}
custom-verification-email-template	arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${TemplateName}
identity	arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}
template	arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}

Condition keys for Amazon SES

Amazon SES defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
ses:ApiVersion	Filters actions based on the SES API version	String
ses:FeedbackAddress	Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding	String
ses:FromAddress	Filters actions based on the "From" address of a message	String
ses:FromDisplayName	Filters actions based on the "From" address that is used as the display name of a message	String
ses:Recipients	Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Security Lake (securitylake)

Amazon Simple Email Service - Mail Manager (ses)