Actions, resources, and condition keys for Amazon Pinpoint Email Service

Amazon Pinpoint Email Service (service prefix: ses) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Pinpoint Email Service
Resource types defined by Amazon Pinpoint Email Service
Condition keys for Amazon Pinpoint Email Service

Actions defined by Amazon Pinpoint Email Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Access level column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Access levels in policy summaries.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
CreateConfigurationSet	Grants permission to create a configuration set	Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateConfigurationSetEventDestination	Grants permission to create a configuration set event destination	Write	configuration-set*
CreateConfigurationSetEventDestination		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
CreateDedicatedIpPool	Grants permission to create a new pool of dedicated IP addresses	Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateDeliverabilityTestReport	Grants permission to create a new predictive inbox placement test	Write	identity*
CreateDeliverabilityTestReport		Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
CreateEmailIdentity	Grants permission to start the process of verifying an email identity	Write		ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
DeleteConfigurationSet	Grants permission to delete an existing configuration set	Write	configuration-set*
DeleteConfigurationSet	Grants permission to delete an existing configuration set	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	Write	configuration-set*
DeleteConfigurationSetEventDestination	Grants permission to delete an event destination	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	Write	dedicated-ip-pool*
DeleteDedicatedIpPool	Grants permission to delete a dedicated IP pool	Write		ses:ApiVersion aws:ResourceTag/${TagKey}
DeleteEmailIdentity	Grants permission to delete an email identity that you previously verified	Write	identity*
DeleteEmailIdentity		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
GetAccount	Grants permission to get information about the email-sending status and capabilities	Read		ses:ApiVersion
GetBlacklistReports	Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses appear	Read		ses:ApiVersion
GetConfigurationSet	Grants permission to get information about an existing configuration set	Read	configuration-set*
GetConfigurationSet		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetConfigurationSetEventDestinations	Grants permission to retrieve a list of event destinations that are associated with a configuration set	Read	configuration-set*
GetConfigurationSetEventDestinations		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDedicatedIp	Grants permission to get information about a dedicated IP address	Read		ses:ApiVersion
GetDedicatedIps	Grants permission to list the dedicated IP addresses that are associated with your account	Read	dedicated-ip-pool*
GetDedicatedIps		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDeliverabilityDashboardOptions	Grants permission to get the status of the Deliverability dashboard	Read		ses:ApiVersion
GetDeliverabilityTestReport	Grants permission to retrieve the results of a predictive inbox placement test	Read	deliverability-test-report*
GetDeliverabilityTestReport		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetDomainDeliverabilityCampaign	Grants permission to retrieve all the deliverability data for a specific campaign	Read		ses:ApiVersion
GetDomainStatisticsReport	Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email	Read	identity*
GetDomainStatisticsReport		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
GetEmailIdentity	Grants permission to get information about a specific identity associated with your account	Read	identity*
GetEmailIdentity		Read		ses:ApiVersion aws:ResourceTag/${TagKey}
ListConfigurationSets	Grants permission to list all of the configuration sets associated with your account	List		ses:ApiVersion
ListDedicatedIpPools	Grants permission to list all of the dedicated IP pools that exist in your account	List		ses:ApiVersion
ListDeliverabilityTestReports	Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses	List		ses:ApiVersion
ListDomainDeliverabilityCampaigns	Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range	Read		ses:ApiVersion
ListEmailIdentities	Grants permission to list all of the email identities that are associated with your account	List		ses:ApiVersion
ListTagsForResource	Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource	Read	configuration-set
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion
PutAccountDedicatedIpWarmupAttributes	Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses	Write		ses:ApiVersion
PutAccountSendingAttributes	Grants permission to enable or disable the ability of your account to send email	Write		ses:ApiVersion
PutConfigurationSetDeliveryOptions	Grants permission to associate a configuration set with a dedicated IP pool	Write	configuration-set*
PutConfigurationSetDeliveryOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetReputationOptions	Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set	Write	configuration-set*
PutConfigurationSetReputationOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetSendingOptions	Grants permission to enable or disable email sending for messages that use a particular configuration set	Write	configuration-set*
PutConfigurationSetSendingOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutConfigurationSetTrackingOptions	Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set	Write	configuration-set*
PutConfigurationSetTrackingOptions		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutDedicatedIpInPool	Grants permission to move a dedicated IP address to an existing dedicated IP pool	Write	dedicated-ip-pool*
PutDedicatedIpInPool		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutDedicatedIpWarmupAttributes	Grants permission to enable dedicated IP warm up attributes	Write		ses:ApiVersion
PutDeliverabilityDashboardOption	Grants permission to enable or disable the Deliverability dashboard	Write		ses:ApiVersion
PutEmailIdentityDkimAttributes	Grants permission to enable or disable DKIM authentication for an email identity	Write	identity*
PutEmailIdentityDkimAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityFeedbackAttributes	Grants permission to enable or disable feedback forwarding for an identity	Write	identity*
PutEmailIdentityFeedbackAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
PutEmailIdentityMailFromAttributes	Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity	Write	identity*
PutEmailIdentityMailFromAttributes		Write		ses:ApiVersion aws:ResourceTag/${TagKey}
SendEmail	Grants permission to send an email message	Write	identity*
SendEmail	Grants permission to send an email message	Write		ses:ApiVersion ses:FeedbackAddress ses:FromAddress ses:FromDisplayName ses:Recipients
TagResource	Grants permission to add one or more tags (keys and values) to a specified resource	Tagging	configuration-set
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to remove one or more tags (keys and values) from a specified resource	Tagging	configuration-set
			dedicated-ip-pool
			deliverability-test-report
			identity
				ses:ApiVersion aws:TagKeys
UpdateConfigurationSetEventDestination	Grants permission to update the configuration of an event destination for a configuration set	Write	configuration-set*
UpdateConfigurationSetEventDestination		Write		ses:ApiVersion aws:ResourceTag/${TagKey}

Resource types defined by Amazon Pinpoint Email Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
configuration-set	`arn:${Partition}:ses:${Region}:${Account}:configuration-set/${ConfigurationSetName}`	aws:ResourceTag/${TagKey}
dedicated-ip-pool	`arn:${Partition}:ses:${Region}:${Account}:dedicated-ip-pool/${DedicatedIPPool}`	aws:ResourceTag/${TagKey}
deliverability-test-report	`arn:${Partition}:ses:${Region}:${Account}:deliverability-test-report/${ReportId}`	aws:ResourceTag/${TagKey}
identity	`arn:${Partition}:ses:${Region}:${Account}:identity/${IdentityName}`	aws:ResourceTag/${TagKey}

Condition keys for Amazon Pinpoint Email Service

Amazon Pinpoint Email Service defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see AWS global condition context keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString
ses:ApiVersion	Filters actions based on the SES API version	String
ses:FeedbackAddress	Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding	String
ses:FromAddress	Filters actions based on the "From" address of a message	String
ses:FromDisplayName	Filters actions based on the "From" address that is used as the display name of a message	String
ses:Recipients	Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Pinpoint

Amazon Pinpoint SMS and Voice Service