Amazon Simple Email Service Construct Library

This module is part of the AWS Cloud Development Kit project.

Email receiving

Create a receipt rule set with rules and actions (actions can be found in the aws-cdk-lib/aws-ses-actions package):

import * as s3 from 'aws-cdk-lib/aws-s3';
import * as actions from 'aws-cdk-lib/aws-ses-actions';

const bucket = new s3.Bucket(this, 'Bucket');
const topic = new sns.Topic(this, 'Topic');

new ses.ReceiptRuleSet(this, 'RuleSet', {
  rules: [
    {
      recipients: ['hello@aws.com'],
      actions: [
        new actions.AddHeader({
          name: 'X-Special-Header',
          value: 'aws',
        }),
        new actions.S3({
          bucket,
          objectKeyPrefix: 'emails/',
          topic,
        }),
      ],
    },
    {
      recipients: ['aws.com'],
      actions: [
        new actions.Sns({
          topic,
        }),
      ],
    },
  ],
});

python

import aws_cdk.aws_s3 as s3
import aws_cdk.aws_ses_actions as actions


bucket = s3.Bucket(self, "Bucket")
topic = sns.Topic(self, "Topic")

ses.ReceiptRuleSet(self, "RuleSet",
    rules=[ses.ReceiptRuleOptions(
        recipients=["hello@aws.com"],
        actions=[
            actions.AddHeader(
                name="X-Special-Header",
                value="aws"
            ),
            actions.S3(
                bucket=bucket,
                object_key_prefix="emails/",
                topic=topic
            )
        ]
    ), ses.ReceiptRuleOptions(
        recipients=["aws.com"],
        actions=[
            actions.Sns(
                topic=topic
            )
        ]
    )
    ]
)

java

import software.amazon.awscdk.services.s3.*;
import software.amazon.awscdk.services.ses.actions.*;


Bucket bucket = new Bucket(this, "Bucket");
Topic topic = new Topic(this, "Topic");

ReceiptRuleSet.Builder.create(this, "RuleSet")
        .rules(List.of(ReceiptRuleOptions.builder()
                .recipients(List.of("hello@aws.com"))
                .actions(List.of(
                    AddHeader.Builder.create()
                            .name("X-Special-Header")
                            .value("aws")
                            .build(),
                    S3.Builder.create()
                            .bucket(bucket)
                            .objectKeyPrefix("emails/")
                            .topic(topic)
                            .build()))
                .build(), ReceiptRuleOptions.builder()
                .recipients(List.of("aws.com"))
                .actions(List.of(
                    Sns.Builder.create()
                            .topic(topic)
                            .build()))
                .build()))
        .build();

csharp

using Amazon.CDK.AWS.S3;
using Amazon.CDK.AWS.SES.Actions;


var bucket = new Bucket(this, "Bucket");
var topic = new Topic(this, "Topic");

new ReceiptRuleSet(this, "RuleSet", new ReceiptRuleSetProps {
    Rules = new [] { new ReceiptRuleOptions {
        Recipients = new [] { "hello@aws.com" },
        Actions = new [] {
            new AddHeader(new AddHeaderProps {
                Name = "X-Special-Header",
                Value = "aws"
            }),
            new S3(new S3Props {
                Bucket = bucket,
                ObjectKeyPrefix = "emails/",
                Topic = topic
            }) }
    }, new ReceiptRuleOptions {
        Recipients = new [] { "aws.com" },
        Actions = new [] {
            new Sns(new SnsProps {
                Topic = topic
            }) }
    } }
});

import s3 "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"


bucket := s3.NewBucket(this, jsii.String("Bucket"))
topic := sns.NewTopic(this, jsii.String("Topic"))

ses.NewReceiptRuleSet(this, jsii.String("RuleSet"), &ReceiptRuleSetProps{
	Rules: []ReceiptRuleOptions{
		&ReceiptRuleOptions{
			Recipients: []*string{
				jsii.String("hello@aws.com"),
			},
			Actions: []IReceiptRuleAction{
				actions.NewAddHeader(&AddHeaderProps{
					Name: jsii.String("X-Special-Header"),
					Value: jsii.String("aws"),
				}),
				actions.NewS3(&S3Props{
					Bucket: *Bucket,
					ObjectKeyPrefix: jsii.String("emails/"),
					Topic: *Topic,
				}),
			},
		},
		&ReceiptRuleOptions{
			Recipients: []*string{
				jsii.String("aws.com"),
			},
			Actions: []IReceiptRuleAction{
				actions.NewSns(&SnsProps{
					Topic: *Topic,
				}),
			},
		},
	},
})

Alternatively, rules can be added to a rule set:

const ruleSet = new ses.ReceiptRuleSet(this, 'RuleSet');

const awsRule = ruleSet.addRule('Aws', {
  recipients: ['aws.com'],
});

python

rule_set = ses.ReceiptRuleSet(self, "RuleSet")

aws_rule = rule_set.add_rule("Aws",
    recipients=["aws.com"]
)

java

ReceiptRuleSet ruleSet = new ReceiptRuleSet(this, "RuleSet");

ReceiptRule awsRule = ruleSet.addRule("Aws", ReceiptRuleOptions.builder()
        .recipients(List.of("aws.com"))
        .build());

csharp

var ruleSet = new ReceiptRuleSet(this, "RuleSet");

var awsRule = ruleSet.AddRule("Aws", new ReceiptRuleOptions {
    Recipients = new [] { "aws.com" }
});

ruleSet := ses.NewReceiptRuleSet(this, jsii.String("RuleSet"))

awsRule := ruleSet.addRule(jsii.String("Aws"), &ReceiptRuleOptions{
	Recipients: []*string{
		jsii.String("aws.com"),
	},
})

And actions to rules:

import * as actions from 'aws-cdk-lib/aws-ses-actions';

declare const awsRule: ses.ReceiptRule;
declare const topic: sns.Topic;
awsRule.addAction(new actions.Sns({
  topic,
}));

python

import aws_cdk.aws_ses_actions as actions

# aws_rule: ses.ReceiptRule
# topic: sns.Topic

aws_rule.add_action(actions.Sns(
    topic=topic
))

java

import software.amazon.awscdk.services.ses.actions.*;

ReceiptRule awsRule;
Topic topic;

awsRule.addAction(Sns.Builder.create()
        .topic(topic)
        .build());

csharp

using Amazon.CDK.AWS.SES.Actions;

ReceiptRule awsRule;
Topic topic;

awsRule.AddAction(new Sns(new SnsProps {
    Topic = topic
}));

import actions "github.com/aws/aws-cdk-go/awscdk"

var awsRule ReceiptRule
var topic Topic

awsRule.AddAction(actions.NewSns(&SnsProps{
	Topic: Topic,
}))

When using addRule, the new rule is added after the last added rule unless after is specified.

Drop spams

A rule to drop spam can be added by setting dropSpam to true:

new ses.ReceiptRuleSet(this, 'RuleSet', {
  dropSpam: true,
});

python

ses.ReceiptRuleSet(self, "RuleSet",
    drop_spam=True
)

java

ReceiptRuleSet.Builder.create(this, "RuleSet")
        .dropSpam(true)
        .build();

csharp

new ReceiptRuleSet(this, "RuleSet", new ReceiptRuleSetProps {
    DropSpam = true
});

ses.NewReceiptRuleSet(this, jsii.String("RuleSet"), &ReceiptRuleSetProps{
	DropSpam: jsii.Boolean(true),
})

This will add a rule at the top of the rule set with a Lambda action that stops processing messages that have at least one spam indicator. See Lambda Function Examples.

Receipt filter

Create a receipt filter:

new ses.ReceiptFilter(this, 'Filter', {
  ip: '1.2.3.4/16', // Will be blocked
});

python

ses.ReceiptFilter(self, "Filter",
    ip="1.2.3.4/16"
)

java

ReceiptFilter.Builder.create(this, "Filter")
        .ip("1.2.3.4/16")
        .build();

csharp

new ReceiptFilter(this, "Filter", new ReceiptFilterProps {
    Ip = "1.2.3.4/16"
});

ses.NewReceiptFilter(this, jsii.String("Filter"), &ReceiptFilterProps{
	Ip: jsii.String("1.2.3.4/16"),
})

An allow list filter is also available:

new ses.AllowListReceiptFilter(this, 'AllowList', {
  ips: [
    '10.0.0.0/16',
    '1.2.3.4/16',
  ],
});

python

ses.AllowListReceiptFilter(self, "AllowList",
    ips=["10.0.0.0/16", "1.2.3.4/16"
    ]
)

java

AllowListReceiptFilter.Builder.create(this, "AllowList")
        .ips(List.of("10.0.0.0/16", "1.2.3.4/16"))
        .build();

csharp

new AllowListReceiptFilter(this, "AllowList", new AllowListReceiptFilterProps {
    Ips = new [] { "10.0.0.0/16", "1.2.3.4/16" }
});

ses.NewAllowListReceiptFilter(this, jsii.String("AllowList"), &AllowListReceiptFilterProps{
	Ips: []*string{
		jsii.String("10.0.0.0/16"),
		jsii.String("1.2.3.4/16"),
	},
})

This will first create a block all filter and then create allow filters for the listed ip addresses.

AWS Service Principal permissions

When adding an s3 action to a receipt rule, the CDK will automatically create a policy statement that allows the ses service principal to get write access to the bucket. This is done with the SourceAccount condition key, which is automatically added to the policy statement. Previously, the policy used the Referer condition key, which caused confused deputy problems when the bucket policy allowed access to the bucket for all principals. See more information in this github issue

Email sending

Dedicated IP pools

When you create a new Amazon SES account, your emails are sent from IP addresses that are shared with other Amazon SES users. For an additional monthly charge, you can lease dedicated IP addresses that are reserved for your exclusive use.

Use the DedicatedIpPool construct to create a pool of dedicated IP addresses. When specifying a name for your dedicated IP pool, ensure that it adheres to the following naming convention:

The name must include only lowercase letters (a-z), numbers (0-9), underscores (_), and hyphens (-).
The name must not exceed 64 characters in length.

new ses.DedicatedIpPool(this, 'Pool', {
  dedicatedIpPoolName: 'mypool',
  scalingMode: ses.ScalingMode.STANDARD,
});

python

ses.DedicatedIpPool(self, "Pool",
    dedicated_ip_pool_name="mypool",
    scaling_mode=ses.ScalingMode.STANDARD
)

java

DedicatedIpPool.Builder.create(this, "Pool")
        .dedicatedIpPoolName("mypool")
        .scalingMode(ScalingMode.STANDARD)
        .build();

csharp

new DedicatedIpPool(this, "Pool", new DedicatedIpPoolProps {
    DedicatedIpPoolName = "mypool",
    ScalingMode = ScalingMode.STANDARD
});

ses.NewDedicatedIpPool(this, jsii.String("Pool"), &DedicatedIpPoolProps{
	DedicatedIpPoolName: jsii.String("mypool"),
	ScalingMode: ses.ScalingMode_STANDARD,
})

The pool can then be used in a configuration set. If the provided dedicatedIpPoolName does not follow the specified naming convention, an error will be thrown.

Configuration sets

Configuration sets are groups of rules that you can apply to your verified identities. A verified identity is a domain, subdomain, or email address you use to send email through Amazon SES. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.

Use the ConfigurationSet construct to create a configuration set:

import { Duration } from 'aws-cdk-lib';

declare const myPool: ses.IDedicatedIpPool;

new ses.ConfigurationSet(this, 'ConfigurationSet', {
  tlsPolicy: ses.ConfigurationSetTlsPolicy.REQUIRE,
  dedicatedIpPool: myPool,
  // Specify maximum delivery time
  // This configuration can be useful in such cases as time-sensitive emails (like those containing a one-time-password),
  // transactional emails, and email that you want to ensure isn't delivered during non-business hours.
  maxDeliveryDuration: Duration.minutes(10),
});

python

from aws_cdk import Duration

# my_pool: ses.IDedicatedIpPool


ses.ConfigurationSet(self, "ConfigurationSet",
    tls_policy=ses.ConfigurationSetTlsPolicy.REQUIRE,
    dedicated_ip_pool=my_pool,
    # Specify maximum delivery time
    # This configuration can be useful in such cases as time-sensitive emails (like those containing a one-time-password),
    # transactional emails, and email that you want to ensure isn't delivered during non-business hours.
    max_delivery_duration=Duration.minutes(10)
)

java

import software.amazon.awscdk.Duration;

IDedicatedIpPool myPool;


ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .tlsPolicy(ConfigurationSetTlsPolicy.REQUIRE)
        .dedicatedIpPool(myPool)
        // Specify maximum delivery time
        // This configuration can be useful in such cases as time-sensitive emails (like those containing a one-time-password),
        // transactional emails, and email that you want to ensure isn't delivered during non-business hours.
        .maxDeliveryDuration(Duration.minutes(10))
        .build();

csharp

using Amazon.CDK;

IDedicatedIpPool myPool;

new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    TlsPolicy = ConfigurationSetTlsPolicy.REQUIRE,
    DedicatedIpPool = myPool,
    // Specify maximum delivery time
    // This configuration can be useful in such cases as time-sensitive emails (like those containing a one-time-password),
    // transactional emails, and email that you want to ensure isn't delivered during non-business hours.
    MaxDeliveryDuration = Duration.Minutes(10)
});

import "github.com/aws/aws-cdk-go/awscdk"

var myPool IDedicatedIpPool


ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	TlsPolicy: ses.ConfigurationSetTlsPolicy_REQUIRE,
	DedicatedIpPool: myPool,
	// Specify maximum delivery time
	// This configuration can be useful in such cases as time-sensitive emails (like those containing a one-time-password),
	// transactional emails, and email that you want to ensure isn't delivered during non-business hours.
	MaxDeliveryDuration: awscdk.Duration_Minutes(jsii.Number(10)),
})

Use addEventDestination() to publish email sending events to Amazon SNS, Amazon CloudWatch, Amazon Data Firehose or Amazon EventBridge:

declare const myConfigurationSet: ses.ConfigurationSet;
declare const myTopic: sns.Topic;

myConfigurationSet.addEventDestination('ToSns', {
  destination: ses.EventDestination.snsTopic(myTopic),
})

python

# my_configuration_set: ses.ConfigurationSet
# my_topic: sns.Topic


my_configuration_set.add_event_destination("ToSns",
    destination=ses.EventDestination.sns_topic(my_topic)
)

java

ConfigurationSet myConfigurationSet;
Topic myTopic;


myConfigurationSet.addEventDestination("ToSns", ConfigurationSetEventDestinationOptions.builder()
        .destination(EventDestination.snsTopic(myTopic))
        .build());

csharp

ConfigurationSet myConfigurationSet;
Topic myTopic;


myConfigurationSet.AddEventDestination("ToSns", new ConfigurationSetEventDestinationOptions {
    Destination = EventDestination.SnsTopic(myTopic)
});

var myConfigurationSet ConfigurationSet
var myTopic Topic


myConfigurationSet.AddEventDestination(jsii.String("ToSns"), &ConfigurationSetEventDestinationOptions{
	Destination: ses.EventDestination_SnsTopic(myTopic),
})

Note: For EventBridge, you must specify the default EventBus:

import * as events from 'aws-cdk-lib/aws-events';

declare const myConfigurationSet: ses.ConfigurationSet;

const bus = events.EventBus.fromEventBusName(this, 'EventBus', 'default');

myConfigurationSet.addEventDestination('ToEventBus', {
  destination: ses.EventDestination.eventBus(bus),
})

python

import aws_cdk.aws_events as events

# my_configuration_set: ses.ConfigurationSet


bus = events.EventBus.from_event_bus_name(self, "EventBus", "default")

my_configuration_set.add_event_destination("ToEventBus",
    destination=ses.EventDestination.event_bus(bus)
)

java

import software.amazon.awscdk.services.events.*;

ConfigurationSet myConfigurationSet;


IEventBus bus = EventBus.fromEventBusName(this, "EventBus", "default");

myConfigurationSet.addEventDestination("ToEventBus", ConfigurationSetEventDestinationOptions.builder()
        .destination(EventDestination.eventBus(bus))
        .build());

csharp

using Amazon.CDK.AWS.Events;

ConfigurationSet myConfigurationSet;


var bus = EventBus.FromEventBusName(this, "EventBus", "default");

myConfigurationSet.AddEventDestination("ToEventBus", new ConfigurationSetEventDestinationOptions {
    Destination = EventDestination.EventBus(bus)
});

import events "github.com/aws/aws-cdk-go/awscdk"

var myConfigurationSet ConfigurationSet


bus := events.EventBus_FromEventBusName(this, jsii.String("EventBus"), jsii.String("default"))

myConfigurationSet.AddEventDestination(jsii.String("ToEventBus"), &ConfigurationSetEventDestinationOptions{
	Destination: ses.EventDestination_EventBus(bus),
})

For Firehose, if you don't specify IAM Role ARN for Amazon SES to send events. An IAM Role will be created automatically following https://docs.aws.amazon.com/ses/latest/dg/event-publishing-add-event-destination-firehose.html.

import * as iam from 'aws-cdk-lib/aws-iam';
import * as firehose from 'aws-cdk-lib/aws-kinesisfirehose';

declare const myConfigurationSet: ses.ConfigurationSet;
declare const firehoseDeliveryStream: firehose.IDeliveryStream;
declare const iamRole: iam.IRole;

// Create IAM Role automatically
myConfigurationSet.addEventDestination('ToFirehose', {
  destination: ses.EventDestination.firehoseDeliveryStream({
    deliveryStream: firehoseDeliveryStream,
  }),
})

// Specify your IAM Role
myConfigurationSet.addEventDestination('ToFirehose', {
  destination: ses.EventDestination.firehoseDeliveryStream({
    deliveryStream: firehoseDeliveryStream,
    role: iamRole,
  }),
})

python

import aws_cdk.aws_iam as iam
import aws_cdk.aws_kinesisfirehose as firehose

# my_configuration_set: ses.ConfigurationSet
# firehose_delivery_stream: firehose.IDeliveryStream
# iam_role: iam.IRole


# Create IAM Role automatically
my_configuration_set.add_event_destination("ToFirehose",
    destination=ses.EventDestination.firehose_delivery_stream(
        delivery_stream=firehose_delivery_stream
    )
)

# Specify your IAM Role
my_configuration_set.add_event_destination("ToFirehose",
    destination=ses.EventDestination.firehose_delivery_stream(
        delivery_stream=firehose_delivery_stream,
        role=iam_role
    )
)

java

import software.amazon.awscdk.services.iam.*;
import software.amazon.awscdk.services.kinesisfirehose.*;

ConfigurationSet myConfigurationSet;
IDeliveryStream firehoseDeliveryStream;
IRole iamRole;


// Create IAM Role automatically
myConfigurationSet.addEventDestination("ToFirehose", ConfigurationSetEventDestinationOptions.builder()
        .destination(EventDestination.firehoseDeliveryStream(FirehoseDeliveryStreamDestination.builder()
                .deliveryStream(firehoseDeliveryStream)
                .build()))
        .build());

// Specify your IAM Role
myConfigurationSet.addEventDestination("ToFirehose", ConfigurationSetEventDestinationOptions.builder()
        .destination(EventDestination.firehoseDeliveryStream(FirehoseDeliveryStreamDestination.builder()
                .deliveryStream(firehoseDeliveryStream)
                .role(iamRole)
                .build()))
        .build());

csharp

using Amazon.CDK.AWS.IAM;
using Amazon.CDK.AWS.KinesisFirehose;

ConfigurationSet myConfigurationSet;
IDeliveryStream firehoseDeliveryStream;
IRole iamRole;


// Create IAM Role automatically
myConfigurationSet.AddEventDestination("ToFirehose", new ConfigurationSetEventDestinationOptions {
    Destination = EventDestination.FirehoseDeliveryStream(new FirehoseDeliveryStreamDestination {
        DeliveryStream = firehoseDeliveryStream
    })
});

// Specify your IAM Role
myConfigurationSet.AddEventDestination("ToFirehose", new ConfigurationSetEventDestinationOptions {
    Destination = EventDestination.FirehoseDeliveryStream(new FirehoseDeliveryStreamDestination {
        DeliveryStream = firehoseDeliveryStream,
        Role = iamRole
    })
});

import iam "github.com/aws/aws-cdk-go/awscdk"
import firehose "github.com/aws/aws-cdk-go/awscdk"

var myConfigurationSet ConfigurationSet
var firehoseDeliveryStream IDeliveryStream
var iamRole IRole


// Create IAM Role automatically
myConfigurationSet.AddEventDestination(jsii.String("ToFirehose"), &ConfigurationSetEventDestinationOptions{
	Destination: ses.EventDestination_FirehoseDeliveryStream(&FirehoseDeliveryStreamDestination{
		DeliveryStream: firehoseDeliveryStream,
	}),
})

// Specify your IAM Role
myConfigurationSet.AddEventDestination(jsii.String("ToFirehose"), &ConfigurationSetEventDestinationOptions{
	Destination: ses.EventDestination_*FirehoseDeliveryStream(&FirehoseDeliveryStreamDestination{
		DeliveryStream: firehoseDeliveryStream,
		Role: iamRole,
	}),
})

Tracking options

You can specify to use a custom redirect domain to handle open and click tracking for email sent with this configuration set by using customTrackingRedirectDomain and customTrackingHttpsPolicy. Detail can be found in Custom tracking domain.

new ses.ConfigurationSet(this, 'ConfigurationSet', {
  customTrackingRedirectDomain: 'track.cdk.dev',
  customTrackingHttpsPolicy: ses.HttpsPolicy.REQUIRE,
});

python

ses.ConfigurationSet(self, "ConfigurationSet",
    custom_tracking_redirect_domain="track.cdk.dev",
    custom_tracking_https_policy=ses.HttpsPolicy.REQUIRE
)

java

ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .customTrackingRedirectDomain("track.cdk.dev")
        .customTrackingHttpsPolicy(HttpsPolicy.REQUIRE)
        .build();

csharp

new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    CustomTrackingRedirectDomain = "track.cdk.dev",
    CustomTrackingHttpsPolicy = HttpsPolicy.REQUIRE
});

ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	CustomTrackingRedirectDomain: jsii.String("track.cdk.dev"),
	CustomTrackingHttpsPolicy: ses.HttpsPolicy_REQUIRE,
})

Note: The custom tracking redirect domain must be verified in Amazon SES. To create verified identities, you can use the EmailIdentity construct.

Override account-level suppression list settings

You can customize account-level suppression list separately for different configuration sets by overriding it with configuration set-level suppression.

For details, see Using configuration set-level suppression to override your account-level suppression list.

By default, the configuration set uses your account-level suppression list settings.

You can disable account-level suppression list by specifying disableSuppressionList to true. Email sent with this configuration set will not use any suppression settings at all.

new ses.ConfigurationSet(this, 'ConfigurationSet', {
  disableSuppressionList: true,
});

python

ses.ConfigurationSet(self, "ConfigurationSet",
    disable_suppression_list=True
)

java

ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .disableSuppressionList(true)
        .build();

csharp

new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    DisableSuppressionList = true
});

ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	DisableSuppressionList: jsii.Boolean(true),
})

You can also override account level settings with configuration set-level suppression enabled. Email sent with this configuration set will only use the suppression conditions you enabled for it (bounces, complaints, or bounces and complaints) - regardless of what your account-level suppression list settings are, it will override them.

// Only bounces will be suppressed.
new ses.ConfigurationSet(this, 'ConfigurationSet', {
  suppressionReasons: ses.SuppressionReasons.BOUNCES_ONLY,
});

// Only complaints will be suppressed.
new ses.ConfigurationSet(this, 'ConfigurationSet', {
  suppressionReasons: ses.SuppressionReasons.COMPLAINTS_ONLY,
});

// Both bounces and complaints will be suppressed.
new ses.ConfigurationSet(this, 'ConfigurationSet', {
  suppressionReasons: ses.SuppressionReasons.BOUNCES_AND_COMPLAINTS,
});

python

# Only bounces will be suppressed.
ses.ConfigurationSet(self, "ConfigurationSet",
    suppression_reasons=ses.SuppressionReasons.BOUNCES_ONLY
)

# Only complaints will be suppressed.
ses.ConfigurationSet(self, "ConfigurationSet",
    suppression_reasons=ses.SuppressionReasons.COMPLAINTS_ONLY
)

# Both bounces and complaints will be suppressed.
ses.ConfigurationSet(self, "ConfigurationSet",
    suppression_reasons=ses.SuppressionReasons.BOUNCES_AND_COMPLAINTS
)

java

// Only bounces will be suppressed.
// Only bounces will be suppressed.
ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .suppressionReasons(SuppressionReasons.BOUNCES_ONLY)
        .build();

// Only complaints will be suppressed.
// Only complaints will be suppressed.
ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .suppressionReasons(SuppressionReasons.COMPLAINTS_ONLY)
        .build();

// Both bounces and complaints will be suppressed.
// Both bounces and complaints will be suppressed.
ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .suppressionReasons(SuppressionReasons.BOUNCES_AND_COMPLAINTS)
        .build();

csharp

// Only bounces will be suppressed.
// Only bounces will be suppressed.
new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    SuppressionReasons = SuppressionReasons.BOUNCES_ONLY
});

// Only complaints will be suppressed.
// Only complaints will be suppressed.
new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    SuppressionReasons = SuppressionReasons.COMPLAINTS_ONLY
});

// Both bounces and complaints will be suppressed.
// Both bounces and complaints will be suppressed.
new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    SuppressionReasons = SuppressionReasons.BOUNCES_AND_COMPLAINTS
});

// Only bounces will be suppressed.
// Only bounces will be suppressed.
ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	SuppressionReasons: ses.SuppressionReasons_BOUNCES_ONLY,
})

// Only complaints will be suppressed.
// Only complaints will be suppressed.
ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	SuppressionReasons: ses.SuppressionReasons_COMPLAINTS_ONLY,
})

// Both bounces and complaints will be suppressed.
// Both bounces and complaints will be suppressed.
ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	SuppressionReasons: ses.SuppressionReasons_BOUNCES_AND_COMPLAINTS,
})

Auto Validation threshold

Auto validation automatically reviews all outbound email addresses before sending and only delivers messages to recipients meeting your selected validation threshold. This protects sender reputation by preventing sends to invalid or risky addresses.

You can override the account-level Auto Validation settings at the configuration set level using autoValidationThreshold:

MANAGED - Amazon SES automatically optimizes threshold based on sending patterns and reputation (recommended)
HIGH - Only addresses with high delivery likelihood (maximum reputation protection)
MEDIUM - Addresses with medium or high delivery likelihood (balances protection with reach)

For more details, see Auto Validation.

new ses.ConfigurationSet(this, 'ConfigurationSet', {
  autoValidationThreshold: ses.AutoValidationThreshold.HIGH,
});

python

ses.ConfigurationSet(self, "ConfigurationSet",
    auto_validation_threshold=ses.AutoValidationThreshold.HIGH
)

java

ConfigurationSet.Builder.create(this, "ConfigurationSet")
        .autoValidationThreshold(AutoValidationThreshold.HIGH)
        .build();

csharp

new ConfigurationSet(this, "ConfigurationSet", new ConfigurationSetProps {
    AutoValidationThreshold = AutoValidationThreshold.HIGH
});

ses.NewConfigurationSet(this, jsii.String("ConfigurationSet"), &ConfigurationSetProps{
	AutoValidationThreshold: ses.AutoValidationThreshold_HIGH,
})

Use disableAutoValidation to turn the feature on or off for this configuration set, regardless of the account-level setting:

// Explicitly disable Auto Validation for this configuration set.
new ses.ConfigurationSet(this, 'NoAutoValidation', {
  disableAutoValidation: true,
});

python

# Explicitly disable Auto Validation for this configuration set.
ses.ConfigurationSet(self, "NoAutoValidation",
    disable_auto_validation=True
)

java

// Explicitly disable Auto Validation for this configuration set.
// Explicitly disable Auto Validation for this configuration set.
ConfigurationSet.Builder.create(this, "NoAutoValidation")
        .disableAutoValidation(true)
        .build();

csharp

// Explicitly disable Auto Validation for this configuration set.
// Explicitly disable Auto Validation for this configuration set.
new ConfigurationSet(this, "NoAutoValidation", new ConfigurationSetProps {
    DisableAutoValidation = true
});

// Explicitly disable Auto Validation for this configuration set.
// Explicitly disable Auto Validation for this configuration set.
ses.NewConfigurationSet(this, jsii.String("NoAutoValidation"), &ConfigurationSetProps{
	DisableAutoValidation: jsii.Boolean(true),
})

Email identity

In Amazon SES, a verified identity is a domain or email address that you use to send or receive email. Before you can send an email using Amazon SES, you must create and verify each identity that you're going to use as a From, Source, Sender, or Return-Path address. Verifying an identity with Amazon SES confirms that you own it and helps prevent unauthorized use.

To verify an identity for a hosted zone, you create an EmailIdentity:

declare const myHostedZone: route53.IPublicHostedZone;

const identity = new ses.EmailIdentity(this, 'Identity', {
  identity: ses.Identity.publicHostedZone(myHostedZone),
  mailFromDomain: 'mail.cdk.dev',
});

python

# my_hosted_zone: route53.IPublicHostedZone


identity = ses.EmailIdentity(self, "Identity",
    identity=ses.Identity.public_hosted_zone(my_hosted_zone),
    mail_from_domain="mail.cdk.dev"
)

java

IPublicHostedZone myHostedZone;


EmailIdentity identity = EmailIdentity.Builder.create(this, "Identity")
        .identity(Identity.publicHostedZone(myHostedZone))
        .mailFromDomain("mail.cdk.dev")
        .build();

csharp

IPublicHostedZone myHostedZone;


var identity = new EmailIdentity(this, "Identity", new EmailIdentityProps {
    Identity = Identity.PublicHostedZone(myHostedZone),
    MailFromDomain = "mail.cdk.dev"
});

var myHostedZone IPublicHostedZone


identity := ses.NewEmailIdentity(this, jsii.String("Identity"), &EmailIdentityProps{
	Identity: ses.Identity_PublicHostedZone(myHostedZone),
	MailFromDomain: jsii.String("mail.cdk.dev"),
})

By default, Easy DKIM with a 2048-bit DKIM key is used.

You can instead configure DKIM authentication by using your own public-private key pair. This process is known as Bring Your Own DKIM (BYODKIM):

declare const myHostedZone: route53.IPublicHostedZone;

new ses.EmailIdentity(this, 'Identity', {
  identity: ses.Identity.publicHostedZone(myHostedZone),
  dkimIdentity: ses.DkimIdentity.byoDkim({
    privateKey: SecretValue.secretsManager('dkim-private-key'),
    publicKey: '...base64-encoded-public-key...',
    selector: 'selector',
  }),
});

python

# my_hosted_zone: route53.IPublicHostedZone


ses.EmailIdentity(self, "Identity",
    identity=ses.Identity.public_hosted_zone(my_hosted_zone),
    dkim_identity=ses.DkimIdentity.byo_dkim(
        private_key=SecretValue.secrets_manager("dkim-private-key"),
        public_key="...base64-encoded-public-key...",
        selector="selector"
    )
)

java

IPublicHostedZone myHostedZone;


EmailIdentity.Builder.create(this, "Identity")
        .identity(Identity.publicHostedZone(myHostedZone))
        .dkimIdentity(DkimIdentity.byoDkim(ByoDkimOptions.builder()
                .privateKey(SecretValue.secretsManager("dkim-private-key"))
                .publicKey("...base64-encoded-public-key...")
                .selector("selector")
                .build()))
        .build();

csharp

IPublicHostedZone myHostedZone;


new EmailIdentity(this, "Identity", new EmailIdentityProps {
    Identity = Identity.PublicHostedZone(myHostedZone),
    DkimIdentity = DkimIdentity.ByoDkim(new ByoDkimOptions {
        PrivateKey = SecretValue.SecretsManager("dkim-private-key"),
        PublicKey = "...base64-encoded-public-key...",
        Selector = "selector"
    })
});

var myHostedZone IPublicHostedZone


ses.NewEmailIdentity(this, jsii.String("Identity"), &EmailIdentityProps{
	Identity: ses.Identity_PublicHostedZone(myHostedZone),
	DkimIdentity: ses.DkimIdentity_ByoDkim(&ByoDkimOptions{
		PrivateKey: awscdk.SecretValue_SecretsManager(jsii.String("dkim-private-key")),
		PublicKey: jsii.String("...base64-encoded-public-key..."),
		Selector: jsii.String("selector"),
	}),
})

When using publicHostedZone() for the identity, all necessary Amazon Route 53 records are created automatically:

CNAME records for Easy DKIM
TXT record for BYOD DKIM
MX and TXT records for the custom MAIL FROM

When working with domain(), records must be created manually:

const identity = new ses.EmailIdentity(this, 'Identity', {
  identity: ses.Identity.domain('cdk.dev'),
});

for (const record of identity.dkimRecords) {
  // create CNAME records using `record.name` and `record.value`
}

python

identity = ses.EmailIdentity(self, "Identity",
    identity=ses.Identity.domain("cdk.dev")
)

for record in identity.dkim_records:
    pass

java

EmailIdentity identity = EmailIdentity.Builder.create(this, "Identity")
        .identity(Identity.domain("cdk.dev"))
        .build();

for (Object record : identity.getDkimRecords()) {
}

csharp

var identity = new EmailIdentity(this, "Identity", new EmailIdentityProps {
    Identity = Identity.Domain("cdk.dev")
});

for (var record in identity.DkimRecords)
{
}

identity := ses.NewEmailIdentity(this, jsii.String("Identity"), &EmailIdentityProps{
	Identity: ses.Identity_Domain(jsii.String("cdk.dev")),
})

for _, record := range identity.DkimRecords {}

Grants

To grant a specific action to a principal use the grant method. For sending emails, grantSendEmail can be used instead:

import * as iam from 'aws-cdk-lib/aws-iam';
declare const user: iam.User;

const identity = new ses.EmailIdentity(this, 'Identity', {
  identity: ses.Identity.domain('cdk.dev'),
});

identity.grantSendEmail(user);

python

import aws_cdk.aws_iam as iam
# user: iam.User


identity = ses.EmailIdentity(self, "Identity",
    identity=ses.Identity.domain("cdk.dev")
)

identity.grant_send_email(user)

java

import software.amazon.awscdk.services.iam.*;
User user;


EmailIdentity identity = EmailIdentity.Builder.create(this, "Identity")
        .identity(Identity.domain("cdk.dev"))
        .build();

identity.grantSendEmail(user);

csharp

using Amazon.CDK.AWS.IAM;
User user;


var identity = new EmailIdentity(this, "Identity", new EmailIdentityProps {
    Identity = Identity.Domain("cdk.dev")
});

identity.GrantSendEmail(user);

import iam "github.com/aws/aws-cdk-go/awscdk"
var user User


identity := ses.NewEmailIdentity(this, jsii.String("Identity"), &EmailIdentityProps{
	Identity: ses.Identity_Domain(jsii.String("cdk.dev")),
})

identity.grantSendEmail(user)

You can also reference an existing email identity using its ARN and grant permissions to it:

import * as iam from 'aws-cdk-lib/aws-iam';
declare const user: iam.User;

// Imports an existing email identity using its ARN.
// This is one way to reference an existing identity; another option is using its name via fromEmailIdentityName.
const importedIdentity = ses.EmailIdentity.fromEmailIdentityArn(this, 'ImportedIdentity',
  'arn:aws:ses:us-east-1:123456789012:identity/example.com');

// Grant send email permission to the imported identity
importedIdentity.grantSendEmail(user);

python

import aws_cdk.aws_iam as iam
# user: iam.User


# Imports an existing email identity using its ARN.
# This is one way to reference an existing identity; another option is using its name via fromEmailIdentityName.
imported_identity = ses.EmailIdentity.from_email_identity_arn(self, "ImportedIdentity", "arn:aws:ses:us-east-1:123456789012:identity/example.com")

# Grant send email permission to the imported identity
imported_identity.grant_send_email(user)

java

import software.amazon.awscdk.services.iam.*;
User user;


// Imports an existing email identity using its ARN.
// This is one way to reference an existing identity; another option is using its name via fromEmailIdentityName.
IEmailIdentity importedIdentity = EmailIdentity.fromEmailIdentityArn(this, "ImportedIdentity", "arn:aws:ses:us-east-1:123456789012:identity/example.com");

// Grant send email permission to the imported identity
importedIdentity.grantSendEmail(user);

csharp

using Amazon.CDK.AWS.IAM;
User user;


// Imports an existing email identity using its ARN.
// This is one way to reference an existing identity; another option is using its name via fromEmailIdentityName.
var importedIdentity = EmailIdentity.FromEmailIdentityArn(this, "ImportedIdentity", "arn:aws:ses:us-east-1:123456789012:identity/example.com");

// Grant send email permission to the imported identity
importedIdentity.GrantSendEmail(user);

import iam "github.com/aws/aws-cdk-go/awscdk"
var user User


// Imports an existing email identity using its ARN.
// This is one way to reference an existing identity; another option is using its name via fromEmailIdentityName.
importedIdentity := ses.EmailIdentity_FromEmailIdentityArn(this, jsii.String("ImportedIdentity"), jsii.String("arn:aws:ses:us-east-1:123456789012:identity/example.com"))

// Grant send email permission to the imported identity
importedIdentity.GrantSendEmail(user)

Virtual Deliverability Manager (VDM)

Virtual Deliverability Manager is an Amazon SES feature that helps you enhance email deliverability, like increasing inbox deliverability and email conversions, by providing insights into your sending and delivery data, and giving advice on how to fix the issues that are negatively affecting your delivery success rate and reputation.

Use the VdmAttributes construct to configure the Virtual Deliverability Manager for your account:

// Enables engagement tracking and optimized shared delivery by default
new ses.VdmAttributes(this, 'Vdm');

python

# Enables engagement tracking and optimized shared delivery by default
ses.VdmAttributes(self, "Vdm")

java

// Enables engagement tracking and optimized shared delivery by default
// Enables engagement tracking and optimized shared delivery by default
new VdmAttributes(this, "Vdm");

csharp

// Enables engagement tracking and optimized shared delivery by default
// Enables engagement tracking and optimized shared delivery by default
new VdmAttributes(this, "Vdm");

// Enables engagement tracking and optimized shared delivery by default
// Enables engagement tracking and optimized shared delivery by default
ses.NewVdmAttributes(this, jsii.String("Vdm"))

If you want to override the VDM settings in the specified configuration set, use vdmOptions in the ConfigurationSet construct.

Note: The configuration set level settings need to be used together with the account level settings. (To set the account level settings using CDK, use the VdmAttributes Construct.) If you enable only the configuration set level settings, VDM will not be enabled until the account level settings are configured. For more information, see Virtual Deliverability Manager settings.

new ses.ConfigurationSet(this, 'ConfigurationSetWithVdmOptions', {
  vdmOptions: {
    engagementMetrics: true,
    optimizedSharedDelivery: true,
  },
});

python

ses.ConfigurationSet(self, "ConfigurationSetWithVdmOptions",
    vdm_options=ses.VdmOptions(
        engagement_metrics=True,
        optimized_shared_delivery=True
    )
)

java

ConfigurationSet.Builder.create(this, "ConfigurationSetWithVdmOptions")
        .vdmOptions(VdmOptions.builder()
                .engagementMetrics(true)
                .optimizedSharedDelivery(true)
                .build())
        .build();

csharp

new ConfigurationSet(this, "ConfigurationSetWithVdmOptions", new ConfigurationSetProps {
    VdmOptions = new VdmOptions {
        EngagementMetrics = true,
        OptimizedSharedDelivery = true
    }
});

ses.NewConfigurationSet(this, jsii.String("ConfigurationSetWithVdmOptions"), &ConfigurationSetProps{
	VdmOptions: &VdmOptions{
		EngagementMetrics: jsii.Boolean(true),
		OptimizedSharedDelivery: jsii.Boolean(true),
	},
})

Types

Name	Kind	Summary
`ConfigurationSet`	Construct (L2)	A configuration set.
`ConfigurationSetEventDestination`	Construct (L2)	A configuration set event destination.
`DedicatedIpPool`	Construct (L2)	A dedicated IP pool.
`EmailIdentity`	Construct (L2)	An email identity.
`ReceiptFilter`	Construct (L2)	A receipt filter.
`ReceiptRule`	Construct (L2)	A new receipt rule.
`ReceiptRuleSet`	Construct (L2)	A new receipt rule set.
`VdmAttributes`	Construct (L2)	Virtual Deliverability Manager (VDM) attributes.
`CfnConfigurationSet`	Construct (L1)	Configuration sets let you create groups of rules that you can apply to the emails you send using Amazon SES.
`CfnConfigurationSetEventDestination`	Construct (L1)	Specifies a configuration set event destination.
`CfnContactList`	Construct (L1)	A list that contains contacts that have subscribed to a particular topic or topics.
`CfnCustomVerificationEmailTemplate`	Construct (L1)	Resource Type definition for AWS::SES::CustomVerificationEmailTemplate.
`CfnDedicatedIpPool`	Construct (L1)	Create a new pool of dedicated IP addresses.
`CfnEmailIdentity`	Construct (L1)	Specifies an identity for using within SES.
`CfnEmailIdentityCertificate`	Construct (L1)	Associates an AWS Certificate Manager certificate with a sender under an SES email identity, so that SES signs the sender's mail with S/MIME.
`CfnMailManagerAddonInstance`	Construct (L1)	Creates an Add On instance for the subscription indicated in the request.
`CfnMailManagerAddonSubscription`	Construct (L1)	Creates a subscription for an Add On representing the acceptance of its terms of use and additional pricing.
`CfnMailManagerAddressList`	Construct (L1)	The structure representing the address lists and address list attribute that will be used in evaluation of boolean expression.
`CfnMailManagerArchive`	Construct (L1)	Creates a new email archive resource for storing and retaining emails.
`CfnMailManagerIngressPoint`	Construct (L1)	Resource to provision an ingress endpoint for receiving email.
`CfnMailManagerRelay`	Construct (L1)	Resource to create an SMTP relay, which can be used within a Mail Manager rule set to forward incoming emails to defined relay destinations.
`CfnMailManagerRuleSet`	Construct (L1)	Resource to create a rule set for a Mail Manager ingress endpoint which contains a list of rules that are evaluated sequentially for each email.
`CfnMailManagerTrafficPolicy`	Construct (L1)	Resource to create a traffic policy for a Mail Manager ingress endpoint which contains policy statements used to evaluate whether incoming emails should be allowed or denied.
`CfnMultiRegionEndpoint`	Construct (L1)	Creates a multi-region endpoint (global-endpoint).
`CfnReceiptFilter`	Construct (L1)	Specify a new IP address filter.
`CfnReceiptRule`	Construct (L1)	Specifies a receipt rule.
`CfnReceiptRuleSet`	Construct (L1)	Creates an empty receipt rule set.
`CfnTemplate`	Construct (L1)	Specifies an email template.
`CfnTenant`	Construct (L1)	Create a tenant.
`CfnVdmAttributes`	Construct (L1)	The Virtual Deliverability Manager (VDM) attributes that apply to your Amazon SES account.
`AddHeaderActionConfig`	Struct	AddHeaderAction configuration.
`AllowListReceiptFilter`	Construct	An allow list receipt filter.
`AllowListReceiptFilterProps`	Struct	Construction properties for am AllowListReceiptFilter.
`AutoValidationThreshold`	Enum	Confidence threshold used by SES Auto Validation to decide whether an outbound recipient address should be delivered to.
`BounceActionConfig`	Struct	BoundAction configuration.
`ByoDkimOptions`	Struct	Options for BYO DKIM.
`CfnConfigurationSet.ArchivingOptionsProperty`	Struct	An object that defines a MailManager archive that is used to preserve emails that you send using the configuration set.
`CfnConfigurationSet.ConditionThresholdProperty`	Struct	The condition threshold settings for suppression validation.
`CfnConfigurationSet.DashboardOptionsProperty`	Struct	An object containing additional settings for your VDM configuration as applicable to the Dashboard.
`CfnConfigurationSet.DeliveryOptionsProperty`	Struct	Specifies the name of the dedicated IP pool to associate with the configuration set and whether messages that use the configuration set are required to use Transport Layer Security (TLS).
`CfnConfigurationSet.GuardianOptionsProperty`	Struct	An object containing additional settings for your VDM configuration as applicable to the Guardian.
`CfnConfigurationSet.OverallConfidenceThresholdProperty`	Struct	The overall confidence threshold settings.
`CfnConfigurationSet.ReputationOptionsProperty`	Struct	Enable or disable collection of reputation metrics for emails that you send using this configuration set in the current AWS Region.
`CfnConfigurationSet.SendingOptionsProperty`	Struct	Used to enable or disable email sending for messages that use this configuration set in the current AWS Region.
`CfnConfigurationSet.SuppressionOptionsProperty`	Struct	An object that contains information about the suppression list preferences for your account.
`CfnConfigurationSet.TrackingOptionsProperty`	Struct	An object that defines the tracking options for a configuration set.
`CfnConfigurationSet.ValidationOptionsProperty`	Struct	An object that contains information about the validation options for your account.
`CfnConfigurationSet.VdmOptionsProperty`	Struct	The Virtual Deliverability Manager (VDM) options that apply to a configuration set.
`CfnConfigurationSetEventDestination.CloudWatchDestinationProperty`	Struct	An object that defines an Amazon CloudWatch destination for email events.
`CfnConfigurationSetEventDestination.DimensionConfigurationProperty`	Struct	An object that defines the dimension configuration to use when you send email events to Amazon CloudWatch.
`CfnConfigurationSetEventDestination.EventBridgeDestinationProperty`	Struct	An object that defines an Amazon EventBridge destination for email events.
`CfnConfigurationSetEventDestination.EventDestinationProperty`	Struct	In the Amazon SES API v2, events include message sends, deliveries, opens, clicks, bounces, complaints and delivery delays.
`CfnConfigurationSetEventDestination.KinesisFirehoseDestinationProperty`	Struct	An object that defines an Amazon Kinesis Data Firehose destination for email events.
`CfnConfigurationSetEventDestination.SnsDestinationProperty`	Struct	Contains the topic ARN associated with an Amazon Simple Notification Service (Amazon SNS) event destination.
`CfnConfigurationSetEventDestinationProps`	Struct	Properties for defining a `CfnConfigurationSetEventDestination`.
`CfnConfigurationSetProps`	Struct	Properties for defining a `CfnConfigurationSet`.
`CfnContactList.TopicProperty`	Struct	An interest group, theme, or label within a list.
`CfnContactListProps`	Struct	Properties for defining a `CfnContactList`.
`CfnCustomVerificationEmailTemplateProps`	Struct	Properties for defining a `CfnCustomVerificationEmailTemplate`.
`CfnDedicatedIpPoolProps`	Struct	Properties for defining a `CfnDedicatedIpPool`.
`CfnEmailIdentity.ConfigurationSetAttributesProperty`	Struct	Used to associate a configuration set with an email identity.
`CfnEmailIdentity.DkimAttributesProperty`	Struct	Used to enable or disable DKIM authentication for an email identity.
`CfnEmailIdentity.DkimSigningAttributesProperty`	Struct	Used to configure or change the DKIM authentication settings for an email domain identity.
`CfnEmailIdentity.FeedbackAttributesProperty`	Struct	Used to enable or disable feedback forwarding for an identity.
`CfnEmailIdentity.MailFromAttributesProperty`	Struct	Used to enable or disable the custom Mail-From domain configuration for an email identity.
`CfnEmailIdentityCertificateProps`	Struct	Properties for defining a `CfnEmailIdentityCertificate`.
`CfnEmailIdentityProps`	Struct	Properties for defining a `CfnEmailIdentity`.
`CfnMailManagerAddonInstanceProps`	Struct	Properties for defining a `CfnMailManagerAddonInstance`.
`CfnMailManagerAddonSubscriptionProps`	Struct	Properties for defining a `CfnMailManagerAddonSubscription`.
`CfnMailManagerAddressListProps`	Struct	Properties for defining a `CfnMailManagerAddressList`.
`CfnMailManagerArchive.ArchiveRetentionProperty`	Struct	The retention policy for an email archive that specifies how long emails are kept before being automatically deleted.
`CfnMailManagerArchiveProps`	Struct	Properties for defining a `CfnMailManagerArchive`.
`CfnMailManagerIngressPoint.IngressPointConfigurationProperty`	Struct	The configuration of the ingress endpoint resource.
`CfnMailManagerIngressPoint.NetworkConfigurationProperty`	Struct	The network type (IPv4-only, Dual-Stack, PrivateLink) of the ingress endpoint resource.
`CfnMailManagerIngressPoint.PrivateNetworkConfigurationProperty`	Struct	Specifies the network configuration for the private ingress point.
`CfnMailManagerIngressPoint.PublicNetworkConfigurationProperty`	Struct	Specifies the network configuration for the public ingress point.
`CfnMailManagerIngressPoint.TlsAuthConfigurationProperty`	Struct
`CfnMailManagerIngressPoint.TrustStoreProperty`	Struct
`CfnMailManagerIngressPointProps`	Struct	Properties for defining a `CfnMailManagerIngressPoint`.
`CfnMailManagerRelay.RelayAuthenticationProperty`	Struct	Authentication for the relay destination server—specify the secretARN where the SMTP credentials are stored, or specify an empty NoAuthentication structure if the relay destination server does not require SMTP credential authentication.
`CfnMailManagerRelayProps`	Struct	Properties for defining a `CfnMailManagerRelay`.
`CfnMailManagerRuleSet.AddHeaderActionProperty`	Struct	The action to add a header to a message.
`CfnMailManagerRuleSet.AnalysisProperty`	Struct	The result of an analysis can be used in conditions to trigger actions.
`CfnMailManagerRuleSet.ArchiveActionProperty`	Struct	The action to archive the email by delivering the email to an Amazon SES archive.
`CfnMailManagerRuleSet.BounceActionProperty`	Struct
`CfnMailManagerRuleSet.DeliverToMailboxActionProperty`	Struct	This action to delivers an email to a mailbox.
`CfnMailManagerRuleSet.DeliverToQBusinessActionProperty`	Struct	The action to deliver incoming emails to an Amazon Q Business application for indexing.
`CfnMailManagerRuleSet.InvokeLambdaActionProperty`	Struct
`CfnMailManagerRuleSet.RelayActionProperty`	Struct	The action relays the email via SMTP to another specific SMTP server.
`CfnMailManagerRuleSet.ReplaceRecipientActionProperty`	Struct	This action replaces the email envelope recipients with the given list of recipients.
`CfnMailManagerRuleSet.RuleActionProperty`	Struct	The action for a rule to take. Only one of the contained actions can be set.
`CfnMailManagerRuleSet.RuleBooleanExpressionProperty`	Struct	A boolean expression to be used in a rule condition.
`CfnMailManagerRuleSet.RuleBooleanToEvaluateProperty`	Struct	The union type representing the allowed types of operands for a boolean condition.
`CfnMailManagerRuleSet.RuleConditionProperty`	Struct	The conditional expression used to evaluate an email for determining if a rule action should be taken.
`CfnMailManagerRuleSet.RuleDmarcExpressionProperty`	Struct	A DMARC policy expression.
`CfnMailManagerRuleSet.RuleIpExpressionProperty`	Struct	An IP address expression matching certain IP addresses within a given range of IP addresses.
`CfnMailManagerRuleSet.RuleIpToEvaluateProperty`	Struct	The IP address to evaluate for this condition.
`CfnMailManagerRuleSet.RuleIsInAddressListProperty`	Struct	The structure type for a boolean condition that provides the address lists and address list attribute to evaluate.
`CfnMailManagerRuleSet.RuleNumberExpressionProperty`	Struct	A number expression to match numeric conditions with integers from the incoming email.
`CfnMailManagerRuleSet.RuleNumberToEvaluateProperty`	Struct	The number to evaluate in a numeric condition expression.
`CfnMailManagerRuleSet.RuleProperty`	Struct	A rule contains conditions, "unless conditions" and actions.
`CfnMailManagerRuleSet.RuleStringExpressionProperty`	Struct	A string expression is evaluated against strings or substrings of the email.
`CfnMailManagerRuleSet.RuleStringToEvaluateProperty`	Struct	The string to evaluate in a string condition expression.
`CfnMailManagerRuleSet.RuleVerdictExpressionProperty`	Struct	A verdict expression is evaluated against verdicts of the email.
`CfnMailManagerRuleSet.RuleVerdictToEvaluateProperty`	Struct	The verdict to evaluate in a verdict condition expression.
`CfnMailManagerRuleSet.S3ActionProperty`	Struct	Writes the MIME content of the email to an S3 bucket.
`CfnMailManagerRuleSet.SendActionProperty`	Struct	Sends the email to the internet using the ses:SendRawEmail API.
`CfnMailManagerRuleSet.SnsActionProperty`	Struct	The action to publish the email content to an Amazon SNS topic.
`CfnMailManagerRuleSetProps`	Struct	Properties for defining a `CfnMailManagerRuleSet`.
`CfnMailManagerTrafficPolicy.IngressAnalysisProperty`	Struct	The Add On ARN and its returned value that is evaluated in a policy statement's conditional expression to either deny or block the incoming email.
`CfnMailManagerTrafficPolicy.IngressBooleanExpressionProperty`	Struct	The structure for a boolean condition matching on the incoming mail.
`CfnMailManagerTrafficPolicy.IngressBooleanToEvaluateProperty`	Struct	The union type representing the allowed types of operands for a boolean condition.
`CfnMailManagerTrafficPolicy.IngressIpToEvaluateProperty`	Struct	The structure for an IP based condition matching on the incoming mail.
`CfnMailManagerTrafficPolicy.IngressIpv4ExpressionProperty`	Struct	The union type representing the allowed types for the left hand side of an IP condition.
`CfnMailManagerTrafficPolicy.IngressIpv6ExpressionProperty`	Struct	The union type representing the allowed types for the left hand side of an IPv6 condition.
`CfnMailManagerTrafficPolicy.IngressIpv6ToEvaluateProperty`	Struct	The structure for an IPv6 based condition matching on the incoming mail.
`CfnMailManagerTrafficPolicy.IngressIsInAddressListProperty`	Struct	The address lists and the address list attribute value that is evaluated in a policy statement's conditional expression to either deny or block the incoming email.
`CfnMailManagerTrafficPolicy.IngressStringExpressionProperty`	Struct	The structure for a string based condition matching on the incoming mail.
`CfnMailManagerTrafficPolicy.IngressStringToEvaluateProperty`	Struct	The union type representing the allowed types for the left hand side of a string condition.
`CfnMailManagerTrafficPolicy.IngressTlsProtocolExpressionProperty`	Struct	The structure for a TLS related condition matching on the incoming mail.
`CfnMailManagerTrafficPolicy.IngressTlsProtocolToEvaluateProperty`	Struct	The union type representing the allowed types for the left hand side of a TLS condition.
`CfnMailManagerTrafficPolicy.PolicyConditionProperty`	Struct	The email traffic filtering conditions which are contained in a traffic policy resource.
`CfnMailManagerTrafficPolicy.PolicyStatementProperty`	Struct	The structure containing traffic policy conditions and actions.
`CfnMailManagerTrafficPolicyProps`	Struct	Properties for defining a `CfnMailManagerTrafficPolicy`.
`CfnMultiRegionEndpoint.DetailsProperty`	Struct	An object that contains configuration details of multi-region endpoint (global-endpoint).
`CfnMultiRegionEndpoint.RouteDetailsItemsProperty`	Struct	An object that contains route configuration.
`CfnMultiRegionEndpointProps`	Struct	Properties for defining a `CfnMultiRegionEndpoint`.
`CfnReceiptFilter.FilterProperty`	Struct	Specifies an IP address filter.
`CfnReceiptFilter.IpFilterProperty`	Struct	A receipt IP address filter enables you to specify whether to accept or reject mail originating from an IP address or range of IP addresses.
`CfnReceiptFilterProps`	Struct	Properties for defining a `CfnReceiptFilter`.
`CfnReceiptRule.ActionProperty`	Struct	An action that Amazon SES can take when it receives an email on behalf of one or more email addresses or domains that you own.
`CfnReceiptRule.AddHeaderActionProperty`	Struct	When included in a receipt rule, this action adds a header to the received email.
`CfnReceiptRule.BounceActionProperty`	Struct	When included in a receipt rule, this action rejects the received email by returning a bounce response to the sender and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
`CfnReceiptRule.ConnectActionProperty`	Struct	When included in a receipt rule, this action parses the received message and starts an email contact in Amazon Connect on your behalf.
`CfnReceiptRule.LambdaActionProperty`	Struct	When included in a receipt rule, this action calls an AWS Lambda function and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
`CfnReceiptRule.RuleProperty`	Struct	Receipt rules enable you to specify which actions Amazon SES should take when it receives mail on behalf of one or more email addresses or domains that you own.
`CfnReceiptRule.S3ActionProperty`	Struct	When included in a receipt rule, this action saves the received message to an Amazon Simple Storage Service (Amazon S3) bucket and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
`CfnReceiptRule.SNSActionProperty`	Struct	The action to publish the email content to an Amazon SNS topic.
`CfnReceiptRule.StopActionProperty`	Struct	When included in a receipt rule, this action terminates the evaluation of the receipt rule set and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
`CfnReceiptRule.WorkmailActionProperty`	Struct	When included in a receipt rule, this action calls Amazon WorkMail and, optionally, publishes a notification to Amazon Simple Notification Service (Amazon SNS).
`CfnReceiptRuleProps`	Struct	Properties for defining a `CfnReceiptRule`.
`CfnReceiptRuleSetProps`	Struct	Properties for defining a `CfnReceiptRuleSet`.
`CfnTemplate.TemplateProperty`	Struct	An object that defines the email template to use for an email message, and the values to use for any message variables in that template.
`CfnTemplateProps`	Struct	Properties for defining a `CfnTemplate`.
`CfnTenant.ResourceAssociationProperty`	Struct	The resource to associate with the tenant.
`CfnTenantProps`	Struct	Properties for defining a `CfnTenant`.
`CfnVdmAttributes.DashboardAttributesProperty`	Struct	An object containing additional settings for your VDM configuration as applicable to the Dashboard.
`CfnVdmAttributes.GuardianAttributesProperty`	Struct	An object containing additional settings for your VDM configuration as applicable to the Guardian.
`CfnVdmAttributesProps`	Struct	Properties for defining a `CfnVdmAttributes`.
`CloudWatchDimension`	Struct	A CloudWatch dimension upon which to categorize your emails.
`CloudWatchDimensionSource`	Enum	Source for CloudWatch dimension.
`ConfigurationSetEventDestinationAttributes`	Struct	Properties of a reference to an existing configuration set event destination.
`ConfigurationSetEventDestinationOptions`	Struct	Options for a configuration set event destination.
`ConfigurationSetEventDestinationProps`	Struct	Properties for a configuration set event destination.
`ConfigurationSetProps`	Struct	Properties for a configuration set.
`ConfigurationSetTlsPolicy`	Enum	TLS policy for a configuration set.
`DedicatedIpPoolProps`	Struct	Properties for a dedicated IP pool.
`DkimIdentity`	Class	The identity to use for DKIM.
`DkimIdentityConfig`	Struct	Configuration for DKIM identity.
`DkimRecord`	Struct	A DKIM record.
`DropSpamReceiptRule`	Construct	A rule added at the top of the rule set to drop spam/virus.
`DropSpamReceiptRuleProps`	Struct
`EasyDkimSigningKeyLength`	Enum	The signing key length for Easy DKIM.
`EmailIdentityProps`	Struct	Properties for an email identity.
`EmailSendingEvent`	Enum	Email sending event.
`EventDestination`	Class	An event destination.
`FirehoseDeliveryStreamDestination`	Struct	An object that defines an Amazon Data Firehose destination for email events.
`HttpsPolicy`	Enum	HTTPS policy option for the protocol of the open and click tracking links for your custom redirect domain.
`IConfigurationSet`	Interface	A configuration set.
`IConfigurationSetEventDestination`	Interface	A configuration set event destination.
`IDedicatedIpPool`	Interface	A dedicated IP pool.
`Identity`	Class	Identity.
`IEmailIdentity`	Interface	An email identity.
`IReceiptRule`	Interface	A receipt rule.
`IReceiptRuleAction`	Interface	An abstract action for a receipt rule.
`IReceiptRuleSet`	Interface	A receipt rule set.
`IVdmAttributes`	Interface	Virtual Deliverability Manager (VDM) attributes.
`LambdaActionConfig`	Struct	LambdaAction configuration.
`MailFromBehaviorOnMxFailure`	Enum	The action to take if the required MX record for the MAIL FROM domain isn't found.
`ReceiptFilterPolicy`	Enum	The policy for the receipt filter.
`ReceiptFilterProps`	Struct	Construction properties for a ReceiptFilter.
`ReceiptRuleActionConfig`	Struct	Properties for a receipt rule action.
`ReceiptRuleAttributes`	Struct	Properties of a reference to an existing receipt rule.
`ReceiptRuleOptions`	Struct	Options to add a receipt rule to a receipt rule set.
`ReceiptRuleProps`	Struct	Construction properties for a ReceiptRule.
`ReceiptRuleSetProps`	Struct	Construction properties for a ReceiptRuleSet.
`S3ActionConfig`	Struct	S3Action configuration.
`ScalingMode`	Enum	Scaling mode to use for this IP pool.
`SNSActionConfig`	Struct	SNSAction configuration.
`StopActionConfig`	Struct	StopAction configuration.
`SuppressionReasons`	Enum	Reasons for which recipient email addresses should be automatically added to your account's suppression list.
`TlsPolicy`	Enum	The type of TLS policy for a receipt rule.
`VdmAttributesProps`	Struct	Properties for the Virtual Deliverability Manager (VDM) attributes.
`VdmOptions`	Struct	Properties for the Virtual Deliverability Manager (VDM) options that apply to the configuration set.
`WorkmailActionConfig`	Struct	WorkmailAction configuration.

Amazon Simple Email Service Construct Library ​

Email receiving ​

Drop spams ​

Receipt filter ​

AWS Service Principal permissions ​

Email sending ​

Dedicated IP pools ​

Configuration sets ​

Tracking options ​

Override account-level suppression list settings ​

Auto Validation threshold ​

Email identity ​

Grants ​

Virtual Deliverability Manager (VDM) ​

Types ​

Amazon Simple Email Service Construct Library

Email receiving

Drop spams

Receipt filter

AWS Service Principal permissions

Email sending

Dedicated IP pools

Configuration sets

Tracking options

Override account-level suppression list settings

Auto Validation threshold

Email identity

Grants

Virtual Deliverability Manager (VDM)

Types