Using Global endpoints in Amazon SES

Amazon SES Global endpoints is a feature that enhances the continuity and reliability of your email sending operations. This chapter will guide you through the concept, setup, and usage of Global endpoints, helping you leverage multi-region sending (MRS) to achieve higher availability and improved disaster recovery capabilities for your email workloads.

What are Global endpoints?

Global endpoints are resources that allow you to distribute your SES outbound workloads across two AWS Regions. Once configured, SES automatically splits your sending traffic between the selected primary and secondary regions. If either region experiences an impairment, SES will automatically shift traffic away from the affected region to maintain continuity of your sending operations.

Key benefits of using Global endpoints include:

How Global endpoints work

When you set up a Global endpoint, you select a primary region (where the endpoint is created) and a secondary region. SES then creates a multi-region endpoint (MREP) that serves as the entry point for your email sending requests.

The Global endpoint setup process synchronizes key artifacts and sending limits from your primary region to your secondary region. This ensures that both regions have equivalent verified identities, configuration sets, and approved sending limits sufficient for all of the expected volume.

Once the Global endpoint is ready and its Endpoint ID is specified in the SendEmail API call, SES automatically routes your outbound traffic evenly between your primary and secondary regions. If either region becomes impaired, traffic will be weighted away from that region towards the other one until the impairment is resolved.

Setting up Global endpoints

Prerequisites

Before creating a Global endpoint you'll first need to grant SES permission to create Service-Linked Roles (SLRs) in your account. These roles enable essential service functionalities and resource access needed to create, use, and monitor Global endpoints. This can be done by implementing the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "ses.amazonaws.com"
        }
      }
    }
  ]
}

Creating a Global endpoint

To create a new Global endpoint:

The creation process may take a few seconds. Once completed, the status of your Global endpoint will change to "Ready."

Using the AWS CLI:

aws sesv2 create-multi-region-endpoint --primary-region us-west-2 --secondary-region us-east-1 --endpoint-name MyGlobalEndpoint

In the preceding example:

Global endpoint states

Global endpoints can have the following states:

Preparing the secondary region

Now that you've created your global endpoint, you must now ensure that the your email sending configuration, including all its components (identities, configuration sets, email templates, and sending limits), is consistent across the primary and secondary regions before utilizing the Global endpoint for sending emails. This alignment is crucial to avoid potential issues and ensure proper email delivery and tracking.

The Region duplication feature in the console assists you by automatically duplicating resources and duplicating account-level settings from the primary to the secondary region that will quickly help you to ensure that both regions have equivalent configurations.

Based on resource dependencies, the order in which you duplicate resources matters. To avoid conflicts, follow the topic order below:

Duplicating configuration sets

You can select multiple configuration sets from your primary region to be duplicated, along with their settings, in the secondary region.

The "Duplicate configuration sets" feature allows you to:

Duplicating verified domain identities

To ensure the Global endpoint configuration works effectively, your sending domain identity needs to be verified in both the primary and secondary regions. SES uses Deterministic Easy DKIM (DEED) to simplify this process.

Deterministic Easy DKIM (DEED) is a feature that generates consistent DKIM tokens across all AWS Regions based on a parent domain that is configured with Easy DKIM. This consistency allows SES to automatically verify a domain in the secondary region once it's verified in the primary region, without requiring additional DNS record updates. Therefore, you must ensure that the domain identity you want to duplicate, that is the parent, is already configured with Easy DKIM.

The "Duplicate verified domain identities" feature allows you to:

Duplicating production limits

SES checks if sending limits are aligned between regions and allows you to request limit increases in the secondary region if needed.

The "Duplicate production limits" feature allows you to:

Using Global endpoints

Integrating with your application

Using a Global endpoint in your application requires that you obtain its Endpoint ID.

Using the AWS CLI:

aws sesv2 get-multi-region-endpoint --endpoint-name MyGlobalEndpoint --region us-west-2

In the preceding example:

Once you've obtained the Endpoint ID of your Global endpoint, you can update your SendEmail or SendBulkEmail API calls to include the Endpoint ID value for the endpoint-id parameter. Here's an example of how to specify the Endpoint ID in a SendEmail API call using the AWS CLI:

aws sesv2 send-email \ 
                --from-email-address "sender@example.com" \ 
                --destination "ToAddresses=recipient@example.com" \ 
                --content "Subject={Data=Test email,Charset=UTF-8},Body={Text={Data=This is a test email sent using Amazon SES Global endpoints.,Charset=UTF-8}}" \ 
                --endpoint-id "abcdef12.g3h"

Replace abcdef12.g3h with the actual Endpoint ID you obtained either through the console or API.

Monitoring and metrics

The Global endpoints feature provides a unified view of your email sending volume across both the primary and secondary regions. You can access these metrics through the Cross-region metrics tab on the Global endpoint details page in the SES console.

Using the AWS CLI:

aws cloudwatch get-metric-statistics \ 
                --namespace AWS/SES \ 
                --metric-name SendCount \ 
                --dimensions Name=ses:multi-region-endpoint-id,Value=abcdef12.g3h \ 
                --start-time 2024-10-01T00:00:00Z \ --end-time 2024-10-31T23:59:59Z \ 
                --period 86400 \ 
                --statistics Sum

Replace abcdef12.g3h with your actual Endpoint ID.

Best practices and considerations

Following these best practices and considerations helps ensure effective utilization, monitoring, and cost optimization of Global endpoints across multiple AWS Regions for improved availability and reliability of email sending capabilities.

Pricing

While exact pricing details are subject to change, Global endpoints are expected to carry a price premium over single-region sending for an equal volume of mail. Despite this increase, the overall cost is anticipated to remain competitive compared to other email service providers.

For the most up-to-date pricing information, please refer to the Amazon SES Pricing page.