Amazon Simple Email Service
Developer Guide (API Version 2010-12-01)

Getting Information from the Delegate Sender for Amazon SES Sending Authorization

Your sending authorization policy must specify at least one principal, which is the entity to which you are granting access. For Amazon SES sending authorization policies, the principal can be an AWS account, an AWS Identity and Access Management (IAM) user, or an AWS service.

The type of principal you choose depends on your preference, but if you want the finest grain control, ask the delegate sender to set up an IAM user so that only one delegate sender can send for you rather than any user in the delegate sender's AWS account. The delegate sender can find information about setting up an IAM user in Creating an IAM User in Your AWS Account in the IAM User Guide.

After you have decided whether you want to grant access to an AWS account, an IAM user, or an AWS service, ask the delegate sender for the AWS account ID or the IAM user's Amazon Resource Name (ARN) so that you can include it in your sending authorization policy. You can refer your delegate sender to the instructions for finding this information in Providing Information to the Identity Owner. If your delegate sender is an AWS service, the service's documentation should provide the service name to use in the policy.