Amazon Pinpoint Email Service (ses)

2026-07-15

166 new actions, 12 new resources, 9 new conditions | 18 updated actions

Additions

    Actions
  • BatchGetMetricData
    • Description:  Grants permission to get metric data on your activity
    • Access:  Read
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • CancelExportJob
    • Description:  Grants permission to cancel an export job
    • Access:  Write
    • Resources: 

      Name: export-job

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:ExportSourceType
  • CloneReceiptRuleSet
    • Description:  Grants permission to create a receipt rule set by cloning an existing one
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateConfigurationSet
    • Description:  Grants permission to create a configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: dedicated-ip-pool

      Required: No

      Name: mailmanager-archive

      Required: No

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateConfigurationSetEventDestination
    • Description:  Grants permission to create a configuration set event destination
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • CreateConfigurationSetTrackingOptions
    • Description:  Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateContact
    • Description:  Grants permission to create a contact
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • CreateContactList
    • Description:  Grants permission to create a contact list
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateCustomVerificationEmailTemplate
    • Description:  Grants permission to create a new custom verification email template
    • Access:  Write
    • Resources: 

      Name: custom-verification-email-template

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateDedicatedIpPool
    • Description:  Grants permission to create a new pool of dedicated IP addresses
    • Access:  Write
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateDeliverabilityTestReport
    • Description:  Grants permission to create a new predictive inbox placement test
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateEmailIdentity
    • Description:  Grants permission to start the process of verifying an email identity
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateEmailIdentityPolicy
    • Description:  Grants permission to create the specified sending authorization policy for the given identity
    • Access:  Permissions management
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • CreateEmailTemplate
    • Description:  Grants permission to create an email template
    • Access:  Write
    • Resources: 

      Name: template

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateExportJob
    • Description:  Grants permission to create an export job
    • Access:  Write
    • Conditions: 

      ses:ApiVersion

      ses:ExportSourceType
  • CreateImportJob
    • Description:  Grants permission to creates an import job for a data destination
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateMultiRegionEndpoint
    • Description:  Grants permission to create a new multi-region endpoint
    • Access:  Write
    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateReceiptFilter
    • Description:  Grants permission to create a new IP address filter
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateReceiptRule
    • Description:  Grants permission to create a receipt rule
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateReceiptRuleSet
    • Description:  Grants permission to create an empty receipt rule set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateTemplate
    • Description:  Grants permission to creates an email template
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • CreateTenant
    • Description:  Grants permission to create a new tenant
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • CreateTenantResourceAssociation
    • Description:  Grants permission to associate a SES resource to a tenant
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:RequestTag/${TagKey}

      aws:TagKeys

      ses:ApiVersion
  • DeleteConfigurationSet
    • Description:  Grants permission to delete an existing configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteConfigurationSetEventDestination
    • Description:  Grants permission to delete an event destination
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteConfigurationSetTrackingOptions
    • Description:  Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteContact
    • Description:  Grants permission to delete a contact from a contact list
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteContactList
    • Description:  Grants permission to delete a contact list with all of its contacts
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteCustomVerificationEmailTemplate
    • Description:  Grants permission to delete an existing custom verification email template
    • Access:  Write
    • Resources: 

      Name: custom-verification-email-template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteDedicatedIpPool
    • Description:  Grants permission to delete a dedicated IP pool
    • Access:  Write
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteEmailIdentity
    • Description:  Grants permission to delete an email identity that you previously verified
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteEmailIdentityPolicy
    • Description:  Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)
    • Access:  Permissions management
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteEmailTemplate
    • Description:  Grants permission to delete an email template
    • Access:  Write
    • Resources: 

      Name: template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteIdentity
    • Description:  Grants permission to delete the specified identity
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteIdentityPolicy
    • Description:  Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)
    • Access:  Permissions management
    • Conditions: 

      ses:ApiVersion
  • DeleteMultiRegionEndpoint
    • Description:  Grants permission to delete a multi-region endpoint
    • Access:  Write
    • Resources: 

      Name: multi-region-endpoint

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteReceiptFilter
    • Description:  Grants permission to delete the specified IP address filter
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteReceiptRule
    • Description:  Grants permission to delete the specified receipt rule
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteReceiptRuleSet
    • Description:  Grants permission to delete the specified receipt rule set and all of the receipt rules it contains
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteSuppressedDestination
    • Description:  Grants permission to remove an email address from the suppression list for your account or tenant
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteTemplate
    • Description:  Grants permission to delete an email template
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DeleteTenant
    • Description:  Grants permission to delete a tenant
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteTenantResourceAssociation
    • Description:  Grants permission to remove an associated SES resource from a tenant
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • DeleteVerifiedEmailAddress
    • Description:  Grants permission to delete the specified email address from the list of verified addresses
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • DescribeActiveReceiptRuleSet
    • Description:  Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • DescribeConfigurationSet
    • Description:  Grants permission to return the details of the specified configuration set
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • DescribeReceiptRule
    • Description:  Grants permission to return the details of the specified receipt rule
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • DescribeReceiptRuleSet
    • Description:  Grants permission to return the details of the specified receipt rule set
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetAccount
    • Description:  Grants permission to get information about the email-sending status and capabilities
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetAccountSendingEnabled
    • Description:  Grants permission to return the email sending status of your account
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetBlacklistReports
    • Description:  Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses appear
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetConfigurationSet
    • Description:  Grants permission to get information about an existing configuration set
    • Access:  Read
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetConfigurationSetEventDestinations
    • Description:  Grants permission to retrieve a list of event destinations that are associated with a configuration set
    • Access:  Read
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetContact
    • Description:  Grants permission to return a contact from a contact list
    • Access:  Read
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetContactList
    • Description:  Grants permission to return contact list metadata
    • Access:  Read
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      ses:ApiVersion
  • GetCustomVerificationEmailTemplate
    • Description:  Grants permission to return the custom email verification template for the template name you specify
    • Access:  Read
    • Resources: 

      Name: custom-verification-email-template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetDedicatedIp
    • Description:  Grants permission to get information about a dedicated IP address
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetDedicatedIpPool
    • Description:  Grants permission to get information about a dedicated IP pool
    • Access:  Read
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetDedicatedIps
    • Description:  Grants permission to list the dedicated IP addresses that are associated with your account
    • Access:  Read
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetDeliverabilityDashboardOptions
    • Description:  Grants permission to get the status of the Deliverability dashboard
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetDeliverabilityTestReport
    • Description:  Grants permission to retrieve the results of a predictive inbox placement test
    • Access:  Read
    • Resources: 

      Name: deliverability-test-report

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetDomainDeliverabilityCampaign
    • Description:  Grants permission to retrieve all the deliverability data for a specific campaign
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetDomainStatisticsReport
    • Description:  Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email
    • Access:  Read
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetEmailAddressInsights
    • Description:  Grants permission to get insights about email address
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetEmailIdentity
    • Description:  Grants permission to get information about a specific identity associated with your account
    • Access:  Read
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetEmailIdentityPolicies
    • Description:  Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)
    • Access:  Read
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetEmailTemplate
    • Description:  Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify
    • Access:  Read
    • Resources: 

      Name: template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetExportJob
    • Description:  Grants permission to get information about an export job
    • Access:  Read
    • Resources: 

      Name: export-job

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:ExportSourceType
  • GetIdentityDkimAttributes
    • Description:  Grants permission to return the current status of Easy DKIM signing for an entity
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetIdentityMailFromDomainAttributes
    • Description:  Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains)
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetIdentityNotificationAttributes
    • Description:  Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetIdentityPolicies
    • Description:  Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetIdentityVerificationAttributes
    • Description:  Grants permission to return the verification status and (for domain identities) the verification token for a list of identities
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetImportJob
    • Description:  Grants permission to provide information about an import job
    • Access:  Read
    • Resources: 

      Name: import-job

      Required: Yes

    • Conditions: 

      ses:ApiVersion
  • GetMessageInsights
    • Description:  Grants permission to provide insights about a message
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetMultiRegionEndpoint
    • Description:  Grants permission to get information about a multi-region endpoint
    • Access:  Read
    • Resources: 

      Name: multi-region-endpoint

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetReputationEntity
    • Description:  Grants permission to retrieve information about a reputation entity's status
    • Access:  Read
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetSendQuota
    • Description:  Grants permission to return the user's current sending limits
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetSendStatistics
    • Description:  Grants permission to returns the user's sending statistics
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetSuppressedDestination
    • Description:  Grants permission to retrieve information about a specific email address that's on the suppression list for your account or tenant
    • Access:  Read
    • Resources: 

      Name: tenant

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • GetTemplate
    • Description:  Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • GetTenant
    • Description:  Grants permission to get information about a tenant
    • Access:  Read
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListConfigurationSets
    • Description:  Grants permission to list all of the configuration sets associated with your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListContactLists
    • Description:  Grants permission to list all of the contact lists available for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListContacts
    • Description:  Grants permission to list the contacts present in a specific contact list
    • Access:  List
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      ses:ApiVersion
  • ListCustomVerificationEmailTemplates
    • Description:  Grants permission to list all of the existing custom verification email templates for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListDedicatedIpPools
    • Description:  Grants permission to list all of the dedicated IP pools that exist in your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListDeliverabilityTestReports
    • Description:  Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListDomainDeliverabilityCampaigns
    • Description:  Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • ListEmailIdentities
    • Description:  Grants permission to list all of the email identities that are associated with your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListEmailTemplates
    • Description:  Grants permission to list all of the email templates for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListExportJobs
    • Description:  Grants permission to list all the exports jobs for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion

      ses:ExportSourceType
  • ListIdentities
    • Description:  Grants permission to list the email identities for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListIdentityPolicies
    • Description:  Grants permission to list all of the email templates for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListImportJobs
    • Description:  Grants permission to list all of the import jobs for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListMultiRegionEndpoints
    • Description:  Grants permission to list all of the multi-region endpoints for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListReceiptFilters
    • Description:  Grants permission to list the IP address filters associated with your account
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • ListReceiptRuleSets
    • Description:  Grants permission to list the receipt rule sets that exist under your account
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • ListRecommendations
    • Description:  Grants permission to list recommendations for your account
    • Access:  Read
    • Resources: 

      Name: identity

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListReputationEntities
    • Description:  Grants permission to retrieve a list of reputation entities
    • Access:  List
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListResourceTenants
    • Description:  Grants permission to list all the tenants associated to a SES resource
    • Access:  List
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListSuppressedDestinations
    • Description:  Grants permission to list email addresses that are on the suppression list for your account or tenant
    • Access:  Read
    • Resources: 

      Name: tenant

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListTemplates
    • Description:  Grants permission to list the email templates present in your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListTenantResources
    • Description:  Grants permission to list all the resources associated to a tenant
    • Access:  List
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ListTenants
    • Description:  Grants permission to list all the tenants for your account
    • Access:  List
    • Conditions: 

      ses:ApiVersion
  • ListVerifiedEmailAddresses
    • Description:  Grants permission to list all of the email addresses that have been verified in your account
    • Access:  Read
    • Conditions: 

      ses:ApiVersion
  • PutAccountDedicatedIpWarmupAttributes
    • Description:  Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutAccountDetails
    • Description:  Grants permission to update your account details
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutAccountSendingAttributes
    • Description:  Grants permission to enable or disable the ability of your account to send email
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutAccountSuppressionAttributes
    • Description:  Grants permission to change the settings for the account-level suppression list
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutAccountVdmAttributes
    • Description:  Grants permission to change the settings for VDM for your account
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutConfigurationSetArchivingOptions
    • Description:  Grants permission to associate a configuration set with a Mail Manager archive
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: mailmanager-archive

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetDeliveryOptions
    • Description:  Grants permission to associate a configuration set with a dedicated IP pool
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

      Name: dedicated-ip-pool

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetReputationOptions
    • Description:  Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetSendingOptions
    • Description:  Grants permission to enable or disable email sending for messages that use a particular configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetSuppressionOptions
    • Description:  Grants permission to specify the account suppression list preferences for a particular configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetTrackingOptions
    • Description:  Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutConfigurationSetVdmOptions
    • Description:  Grants permission to override account-level VDM settings for a particular configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutDedicatedIpInPool
    • Description:  Grants permission to move a dedicated IP address to an existing dedicated IP pool
    • Access:  Write
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutDedicatedIpPoolScalingAttributes
    • Description:  Grants permission to transition a dedicated IP pool from Standard to Managed
    • Access:  Write
    • Resources: 

      Name: dedicated-ip-pool

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutDedicatedIpWarmupAttributes
    • Description:  Grants permission to enable dedicated IP warm up attributes
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutDeliverabilityDashboardOption
    • Description:  Grants permission to enable or disable the Deliverability dashboard
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • PutEmailIdentityConfigurationSetAttributes
    • Description:  Grants permission to associate a configuration set with an email identity
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutEmailIdentityDkimAttributes
    • Description:  Grants permission to enable or disable DKIM authentication for an email identity
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutEmailIdentityDkimSigningAttributes
    • Description:  Grants permission to configure or change the DKIM authentication settings for an email domain identity
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutEmailIdentityFeedbackAttributes
    • Description:  Grants permission to enable or disable feedback forwarding for an identity
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutEmailIdentityMailFromAttributes
    • Description:  Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutIdentityPolicy
    • Description:  Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain)
    • Access:  Permissions management
    • Conditions: 

      ses:ApiVersion
  • PutSuppressedDestination
    • Description:  Grants permission to add an email address to the suppression list for your account or tenant
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: No

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • PutTenantSuppressionAttributes
    • Description:  Grants permission to change the settings for the tenant-level suppression list
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • ReorderReceiptRuleSet
    • Description:  Grants permission to reorder the receipt rules within a receipt rule set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • ReplicateEmailIdentityDkimSigningKey
    • Description:  Grants permission to replicate email identity DKIM signing key
    • Access:  Permissions management
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      ses:ReplicaRegion
  • SendBounce
    • Description:  Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES
    • Access:  Write
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:FromAddress
  • SendBulkEmail
    • Description:  Grants permission to compose an email message to multiple destinations
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:MultiRegionEndpointId

      ses:TenantName
  • SendBulkTemplatedEmail
    • Description:  Grants permission to compose an email message to multiple destinations
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:FeedbackAddress

      ses:FromAddress

      ses:FromDisplayName

      ses:Recipients
  • SendCustomVerificationEmail
    • Description:  Grants permission to add an email address to the list of identities and attempts to verify it for your account
    • Access:  Write
    • Resources: 

      Name: custom-verification-email-template

      Required: Yes

      Name: identity

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:FeedbackAddress

      ses:FromAddress

      ses:FromDisplayName

      ses:Recipients
  • SendEmail
    • Description:  Grants permission to send an email message
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

      Name: template

      Required: No

    • Conditions: 

      ses:ApiVersion

      ses:FeedbackAddress

      ses:FromAddress

      ses:FromDisplayName

      ses:MultiRegionEndpointId

      ses:Recipients

      ses:TenantName
  • SendRawEmail
    • Description:  Grants permission to send an email message, with header and content specified by the client
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:FeedbackAddress

      ses:FromAddress

      ses:FromDisplayName

      ses:Recipients
  • SendTemplatedEmail
    • Description:  Grants permission to compose an email message using an email template
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: No

      Name: identity

      Required: Yes

      Name: template

      Required: Yes

    • Conditions: 

      ses:ApiVersion

      ses:FeedbackAddress

      ses:FromAddress

      ses:FromDisplayName

      ses:Recipients
  • SetActiveReceiptRuleSet
    • Description:  Grants permission to set the specified receipt rule set as the active receipt rule set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetIdentityDkimEnabled
    • Description:  Grants permission to enable or disable Easy DKIM signing of email sent from an identity
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetIdentityFeedbackForwardingEnabled
    • Description:  Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain)
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetIdentityHeadersInNotificationsEnabled
    • Description:  Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain)
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetIdentityMailFromDomain
    • Description:  Grants permission to enable or disable the custom MAIL FROM domain setup for a verified identity
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetIdentityNotificationTopic
    • Description:  Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • SetReceiptRulePosition
    • Description:  Grants permission to set the position of the specified receipt rule in the receipt rule set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • TestRenderEmailTemplate
    • Description:  Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data
    • Access:  Write
    • Resources: 

      Name: template

      Required: Yes

    • Conditions: 

      ses:ApiVersion
  • TestRenderTemplate
    • Description:  Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateAccountSendingEnabled
    • Description:  Grants permission to enable or disable email sending for your account
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateConfigurationSetEventDestination
    • Description:  Grants permission to update the configuration of an event destination for a configuration set
    • Access:  Write
    • Resources: 

      Name: configuration-set

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateConfigurationSetReputationMetricsEnabled
    • Description:  Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateConfigurationSetSendingEnabled
    • Description:  Grants permission to enable or disable email sending for messages sent using a specific configuration set
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateConfigurationSetTrackingOptions
    • Description:  Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateContact
    • Description:  Grants permission to update a contact's preferences for a list
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateContactList
    • Description:  Grants permission to update contact list metadata
    • Access:  Write
    • Resources: 

      Name: contact-list

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateCustomVerificationEmailTemplate
    • Description:  Grants permission to update an existing custom verification email template
    • Access:  Write
    • Resources: 

      Name: custom-verification-email-template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateEmailIdentityPolicy
    • Description:  Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain)
    • Access:  Permissions management
    • Resources: 

      Name: identity

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateEmailTemplate
    • Description:  Grants permission to update an email template
    • Access:  Write
    • Resources: 

      Name: template

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateReceiptRule
    • Description:  Grants permission to update a receipt rule
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • UpdateReputationEntityCustomerManagedStatus
    • Description:  Grants permission to update the customer-managed sending status
    • Access:  Write
    • Resources: 

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateReputationEntityPolicy
    • Description:  Grants permission to assign a reputation policy
    • Access:  Write
    • Resources: 

      Name: reputation-policy

      Required: Yes

      Name: tenant

      Required: Yes

    • Conditions: 

      aws:ResourceTag/${TagKey}

      ses:ApiVersion
  • UpdateTemplate
    • Description:  Grants permission to update an email template
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • VerifyDomainDkim
    • Description:  Grants permission to return a set of DKIM tokens for a domain
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • VerifyDomainIdentity
    • Description:  Grants permission to verify a domain
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • VerifyEmailAddress
    • Description:  Grants permission to verify an email address
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
  • VerifyEmailIdentity
    • Description:  Grants permission to verify an email identity
    • Access:  Write
    • Conditions: 

      ses:ApiVersion
    Resources
  • configuration-set
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • contact-list
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:contact-list/${ContactListName}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • custom-verification-email-template
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${TemplateName}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • dedicated-ip-pool
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${DedicatedIPPool}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • deliverability-test-report
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${ReportId}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • export-job
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:export-job/${ExportJobId}
  • identity
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • import-job
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:import-job/${ImportJobId}
  • multi-region-endpoint
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:multi-region-endpoint/${EndpointName}
  • reputation-policy
    • Arn:  arn:${Partition}:ses:${Region}:aws:reputation-policy/${ReputationPolicyName}
  • template
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}
    • Conditions: 

      aws:ResourceTag/${TagKey}
  • tenant
    • Arn:  arn:${Partition}:ses:${Region}:${Account}:tenant/${TenantName}/${TenantId}
    • Conditions: 

      aws:ResourceTag/${TagKey}
    Conditions
  • ses:ApiVersion
    • Description:  Filters actions based on the SES API version
    • Type:  String
  • ses:ExportSourceType
    • Description:  Filters access by the export source type
    • Type:  String
  • ses:FeedbackAddress
    • Description:  Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding
    • Type:  String
  • ses:FromAddress
    • Description:  Filters actions based on the "From" address of a message
    • Type:  String
  • ses:FromDisplayName
    • Description:  Filters actions based on the "From" address that is used as the display name of a message
    • Type:  String
  • ses:MultiRegionEndpointId
    • Description:  Filters access by the multi-region endpoint ID that is used to send email
    • Type:  String
  • ses:Recipients
    • Description:  Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses
    • Type:  ArrayOfString
  • ses:ReplicaRegion
    • Description:  Filters access by the replica regions for Replicating domain DKIM signing key
    • Type:  ArrayOfString
  • ses:TenantName
    • Description:  Filters access by the tenant name that is used to send email
    • Type:  String

Updates