Setting up an AWS SES API User

There's SMTP and there's API Users. API User is easier and more straightforward, I feel.

1. Create the Identity and Tenant in the correct Region. Identities | Amazon Simple Email Service | us-east-2
   1. You can create the tenant while creating the SES Identity
2. Ensure you do all the domain validation to send email
3. Create a policy that ensures your new user can only send email from the domain it is supposed to (see below for my policy JSON)
4. Go IAM Users to create your user:  IAM users | IAM | Global
5. Create a user: Create user | IAM | Global
6. Select your policy. Change the filter to “Customer Managed”
7. Go into user and create access key
   1. Third Party (need to research temporary IAM roles)
8. Write down your access cause you won't ever see it again.
    

Now you can send email using the API credentials instead of the SMTP credentials.

You can use my Toolshed.Mailman.AwsSes NuGet if you're looking for an easy way to send mail using AWS SES. There's also Toolshed.Mailman if you need to send using SMTP.

This is the JSON for the policy that I use. You need to use your subscription ID (usually in the header in the upper right). The domain will be whatever domain you set up in SES. The tenant you created. If you cannot find the Id (I never can), ask the AWS AI Agent to get it for you. Tweak this as you see fit for your use case.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowSESEmailSending",
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail",
                "ses:SendTemplatedEmail",
                "ses:SendBulkTemplatedEmail"
            ],
            "Resource": [
                "arn:aws:ses:us-east-2:[your subscription ID]:identity/[domain]",
                "arn:aws:ses:us-east-2:[your subscription ID]:identity/*@[domain]",
                "arn:aws:ses:us-east-2:[your subscription ID]:configuration-set/Default",
                "arn:aws:ses:us-east-2:[your subscription ID]:tenant/[tenant name]/tn-[tenant Id]"
            ]
        },
        {
            "Sid": "AllowSESStatusChecking",
            "Effect": "Allow",
            "Action": [
                "ses:GetSendQuota",
                "ses:GetSendStatistics",
                "ses:GetAccountSendingEnabled"
            ],
            "Resource": "*"
        },
        {
            "Sid": "RestrictFromAddress",
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail",
                "ses:SendTemplatedEmail"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "ses:FromAddress": "*@[domain]"
                }
            }
        }
    ]
}