Actions, resources, and condition keys for Amazon Simple Email Service v2

Amazon Simple Email Service v2 (service prefix: ses) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Simple Email Service v2
Resource types defined by Amazon Simple Email Service v2
Condition keys for Amazon Simple Email Service v2

Actions defined by Amazon Simple Email Service v2

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
BatchGetMetricData	Grants permission to get metric data on your activity	Read	configuration-set
			identity
				ses:ApiVersion aws:ResourceTag/${TagKey}
CancelExportJob	Grants permission to cancel an export job	Write	export-job*
CancelExportJob	Grants permission to cancel an export job	Write		ses:ApiVersion ses:ExportSourceType
CreateConfigurationSet	Grants permission to create a new configuration set	Write	configuration-set*
CreateConfigurationSet	Grants permission to create a new configuration set	Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateConfigurationSetEventDestination	Grants permission to create a configuration set event destination	Write	configuration-set*
CreateConfigurationSetEventDestination		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
CreateContact	Grants permission to create a contact	Write	contact-list*
CreateContact	Grants permission to create a contact	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
CreateContactList	Grants permission to create a contact list	Write	contact-list*
CreateContactList	Grants permission to create a contact list	Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateCustomVerificationEmailTemplate	Grants permission to create a new custom verification email template	Write	custom-verification-email-template*
CreateCustomVerificationEmailTemplate		Write		ses:ApiVersion
CreateDedicatedIpPool	Grants permission to create a new pool of dedicated IP addresses	Write	dedicated-ip-pool*
CreateDedicatedIpPool		Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateDeliverabilityTestReport	Grants permission to create a new predictive inbox placement test	Write	identity*
CreateDeliverabilityTestReport		Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateEmailIdentity	Grants permission to start the process of verifying an email identity	Write	identity*
CreateEmailIdentity		Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateEmailIdentityPolicy	Grants permission to create the specified sending authorization policy for the given identity	Permissions management	identity*
CreateEmailIdentityPolicy		Permissions management		ses:ApiVersion aws:ResourceTag/${TagKey}
CreateEmailTemplate	Grants permission to create an email template	Write	template*
CreateEmailTemplate	Grants permission to create an email template	Write		ses:ApiVersion
CreateExportJob	Grants permission to create an export job	Write		ses:ApiVersion ses:ExportSourceType
CreateImportJob	Grants permission to creates an import job for a data destination	Write		ses:ApiVersion
DeleteConfigurationSet	Grants permission to delete an existing configuration set	Write	configuration-set*
DeleteConfigurationSet	Grants permission to delete an existing configuration set	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	Write	configuration-set*
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteContact	Grants permission to delete a contact from a contact list	Write	contact-list*
DeleteContact	Grants permission to delete a contact from a contact list	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteContactList	Grants permission to delete a contact list with all of its contacts	Write	contact-list*
DeleteContactList		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteCustomVerificationEmailTemplate	Grants permission to delete an existing custom verification email template	Write	custom-verification-email-template*
DeleteCustomVerificationEmailTemplate		Write		ses:ApiVersion
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	Write	dedicated-ip-pool*
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteEmailIdentity	Grants permission to delete an email identity	Write	identity*
DeleteEmailIdentity	Grants permission to delete an email identity	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteEmailIdentityPolicy	Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain)	Permissions management	identity*
DeleteEmailIdentityPolicy		Permissions management		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteEmailTemplate	Grants permission to delete an email template	Write	template*
DeleteEmailTemplate	Grants permission to delete an email template	Write		ses:ApiVersion
DeleteSuppressedDestination	Grants permission to remove an email address from the suppression list for your account	Write		ses:ApiVersion
GetAccount	Grants permission to get information about the email-sending status and capabilities for your account	Read		ses:ApiVersion
GetBlacklistReports	Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses or tracked domains appear	Read		ses:ApiVersion
GetConfigurationSet	Grants permission to get information about an existing configuration set	Read	configuration-set*
GetConfigurationSet		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetConfigurationSetEventDestinations	Grants permission to retrieve a list of event destinations that are associated with a configuration set	Read	configuration-set*
GetConfigurationSetEventDestinations		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetContact	Grants permission to return a contact from a contact list	Read	contact-list*
GetContact	Grants permission to return a contact from a contact list	Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetContactList	Grants permission to return contact list metadata	Read	contact-list*
GetContactList	Grants permission to return contact list metadata	Read		ses:ApiVersion
GetCustomVerificationEmailTemplate	Grants permission to return the custom email verification template for the template name you specify	Read	custom-verification-email-template*
GetCustomVerificationEmailTemplate		Read		ses:ApiVersion
GetDedicatedIp	Grants permission to get information about a dedicated IP address	Read		ses:ApiVersion
GetDedicatedIpPool	Grants permission to get information about a dedicated IP pool	Read	dedicated-ip-pool*
GetDedicatedIpPool		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDedicatedIps	Grants permission to list the dedicated IP addresses a dedicated IP pool	Read	dedicated-ip-pool*
GetDedicatedIps		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDeliverabilityDashboardOptions	Grants permission to get the status of the Deliverability dashboard	Read		ses:ApiVersion
GetDeliverabilityTestReport	Grants permission to retrieve the results of a predictive inbox placement test	Read	deliverability-test-report*
GetDeliverabilityTestReport		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDomainDeliverabilityCampaign	Grants permission to retrieve all the deliverability data for a specific campaign	Read		ses:ApiVersion
GetDomainStatisticsReport	Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email	Read	identity*
GetDomainStatisticsReport		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetEmailIdentity	Grants permission to get information about a specific identity	Read	identity*
GetEmailIdentity		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetEmailIdentityPolicies	Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain)	Read	identity*
GetEmailIdentityPolicies		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetEmailTemplate	Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify	Read	template*
GetEmailTemplate		Read		ses:ApiVersion
GetExportJob	Grants permission to get information about an export job	Read	export-job*
GetExportJob	Grants permission to get information about an export job	Read		ses:ApiVersion ses:ExportSourceType
GetImportJob	Grants permission to provide information about an import job	Read	import-job*
GetImportJob		Read		ses:ApiVersion
GetMessageInsights	Grants permission to provide insights about a message	Read		ses:ApiVersion
GetSuppressedDestination	Grants permission to retrieve information about a specific email address that's on the suppression list for your account	Read		ses:ApiVersion
ListConfigurationSets	Grants permission to list all of the configuration sets for your account	List		ses:ApiVersion
ListContactLists	Grants permission to list all of the contact lists available for your account	List		ses:ApiVersion
ListContacts	Grants permission to list the contacts present in a specific contact list	List	contact-list*
ListContacts		List		ses:ApiVersion
ListCustomVerificationEmailTemplates	Grants permission to list all of the existing custom verification email templates for your account	List		ses:ApiVersion
ListDedicatedIpPools	Grants permission to list all of the dedicated IP pools for your account	List		ses:ApiVersion
ListDeliverabilityTestReports	Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account	List		ses:ApiVersion
ListDomainDeliverabilityCampaigns	Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range	Read		ses:ApiVersion
ListEmailIdentities	Grants permission to list the email identities for your account	List		ses:ApiVersion
ListEmailTemplates	Grants permission to list all of the email templates for your account	List		ses:ApiVersion
ListExportJobs	Grants permission to list all the exports jobs for your account	List		ses:ApiVersion ses:ExportSourceType
ListImportJobs	Grants permission to list all of the import jobs for your account	List		ses:ApiVersion
ListRecommendations	Grants permission to list recommendations for your account	Read	identity
ListRecommendations	Grants permission to list recommendations for your account	Read		ses:ApiVersion aws:ResourceTag/${TagKey}
ListSuppressedDestinations	Grants permission to list email addresses that are on the suppression list for your account	Read		ses:ApiVersion
ListTagsForResource	Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account	Read	configuration-set
			contact-list
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion
PutAccountDedicatedIpWarmupAttributes	Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses	Write		ses:ApiVersion
PutAccountDetails	Grants permission to update your account details	Write		ses:ApiVersion
PutAccountSendingAttributes	Grants permission to enable or disable the ability to send email for your account	Write		ses:ApiVersion
PutAccountSuppressionAttributes	Grants permission to change the settings for the account-level suppression list	Write		ses:ApiVersion
PutAccountVdmAttributes	Grants permission to change the settings for VDM for your account	Write		ses:ApiVersion
PutConfigurationSetDeliveryOptions	Grants permission to associate a configuration set with a dedicated IP pool	Write	configuration-set*
PutConfigurationSetDeliveryOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetReputationOptions	Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set	Write	configuration-set*
PutConfigurationSetReputationOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetSendingOptions	Grants permission to enable or disable email sending for messages that use a particular configuration set	Write	configuration-set*
PutConfigurationSetSendingOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetSuppressionOptions	Grants permission to specify the account suppression list preferences for a particular configuration set	Write	configuration-set*
PutConfigurationSetSuppressionOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetTrackingOptions	Grants permission to specify a custom domain to use for open and click tracking elements in email that you send for a particular configuration set	Write	configuration-set*
PutConfigurationSetTrackingOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetVdmOptions	Grants permission to override account-level VDM settings for a particular configuration set	Write	configuration-set*
PutConfigurationSetVdmOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutDedicatedIpInPool	Grants permission to move a dedicated IP address to an existing dedicated IP pool	Write	dedicated-ip-pool*
PutDedicatedIpInPool		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutDedicatedIpPoolScalingAttributes	Grants permission to transition a dedicated IP pool from Standard to Managed	Write	dedicated-ip-pool*
PutDedicatedIpPoolScalingAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutDedicatedIpWarmupAttributes	Grants permission to put Dedicated IP warm up attributes	Write		ses:ApiVersion
PutDeliverabilityDashboardOption	Grants permission to enable or disable the Deliverability dashboard	Write		ses:ApiVersion
PutEmailIdentityConfigurationSetAttributes	Grants permission to associate a configuration set with an email identity	Write	identity*
			configuration-set
				ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityDkimAttributes	Grants permission to enable or disable DKIM authentication for an email identity	Write	identity*
PutEmailIdentityDkimAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityDkimSigningAttributes	Grants permission to configure or change the DKIM authentication settings for an email domain identity	Write	identity*
PutEmailIdentityDkimSigningAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityFeedbackAttributes	Grants permission to enable or disable feedback forwarding for an email identity	Write	identity*
PutEmailIdentityFeedbackAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityMailFromAttributes	Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity	Write	identity*
PutEmailIdentityMailFromAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutSuppressedDestination	Grants permission to add an email address to the suppression list	Write		ses:ApiVersion
SendBulkEmail	Grants permission to compose an email message to multiple destinations	Write	identity*
			template*
			configuration-set
				ses:ApiVersion
SendCustomVerificationEmail	Grants permission to add an email address to the list of identities and attempts to verify it	Write	custom-verification-email-template*
SendCustomVerificationEmail		Write		ses:ApiVersion
SendEmail	Grants permission to send an email message	Write	identity*
			configuration-set
			template
				ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
TagResource	Grants permission to add one or more tags (keys and values) to a specified resource	Tagging	configuration-set
			contact-list
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
TestRenderEmailTemplate	Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data	Write	template*
TestRenderEmailTemplate		Write		ses:ApiVersion
UntagResource	Grants permission to remove one or more tags (keys and values) from a specified resource	Tagging	configuration-set
			contact-list
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion aws:TagKeys
UpdateConfigurationSetEventDestination	Grants permission to update the configuration of an event destination for a configuration set	Write	configuration-set*
UpdateConfigurationSetEventDestination		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
UpdateContact	Grants permission to update a contact's preferences for a list	Write	contact-list*
UpdateContact		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
UpdateContactList	Grants permission to update contact list metadata	Write	contact-list*
UpdateContactList	Grants permission to update contact list metadata	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
UpdateCustomVerificationEmailTemplate	Grants permission to update an existing custom verification email template	Write	custom-verification-email-template*
UpdateCustomVerificationEmailTemplate		Write		ses:ApiVersion
UpdateEmailIdentityPolicy	Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain)	Permissions management	identity*
UpdateEmailIdentityPolicy		Permissions management		ses:ApiVersion aws:ResourceTag/${TagKey}
UpdateEmailTemplate	Grants permission to update an email template	Write	template*
UpdateEmailTemplate	Grants permission to update an email template	Write		ses:ApiVersion

Resource types defined by Amazon Simple Email Service v2

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
configuration-set	`arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}`	aws:ResourceTag/${TagKey}
contact-list	`arn:${Partition}:ses:${Region}:${Account}:contact-list/${ContactListName}`	aws:ResourceTag/${TagKey}
custom-verification-email-template	`arn:${Partition}:ses:${Region}:${Account}:custom-verification-email-template/${TemplateName}`
dedicated-ip-pool	`arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${DedicatedIPPool}`	aws:ResourceTag/${TagKey}
deliverability-test-report	`arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${ReportId}`	aws:ResourceTag/${TagKey}
export-job	`arn:${Partition}:ses:${Region}:${Account}:export-job/${ExportJobId}`
identity	`arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}`	aws:ResourceTag/${TagKey}
import-job	`arn:${Partition}:ses:${Region}:${Account}:import-job/${ImportJobId}`
template	`arn:${Partition}:ses:${Region}:${Account}:template/${TemplateName}`

Condition keys for Amazon Simple Email Service v2

Amazon Simple Email Service v2 defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
ses:ApiVersion	Filters access by the SES API version	String
ses:ExportSourceType	Filters access by the export source type	String
ses:FeedbackAddress	Filters access by the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding	String
ses:FromAddress	Filters access by the "From" address of a message	String
ses:FromDisplayName	Filters access by the "From" address that is used as the display name of a message	String
ses:Recipients	Filters access by the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Simple Email Service - Mail Manager

Amazon Simple Workflow Service