> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/emails/integrations/providers/aws-ses.md).

# AWS SES

Connect AWS SES (Amazon Simple Email Service) to Email.

Amazon SES sends email from your own AWS account — usually the cheapest choice at high volume when you already run on AWS.

## Get your credentials

1. Open the [Amazon SES console](https://console.aws.amazon.com/ses/) and pick your region, for example `eu-central-1` (Frankfurt).
2. **Identities → Create identity:** verify your domain `acme.com` (recommended) or one address. Copy the identity's ARN, for example `arn:aws:ses:eu-central-1:123456789012:identity/acme.com`.
3. If the account is still in the SES sandbox, request production access. In the sandbox SES delivers only to verified addresses.
4. Optional: create a configuration set, for example `cs-for-acme`.
5. Decide how Norbix signs in: an **IAM User** with an access key (works everywhere), or a **Cross-Account Role** (only when Norbix itself runs on AWS). The Norbix form walks you through the IAM steps.

## Connect it in Cloud

**Where:** Email → Integrations → **Add New Integration** → AWS SES → **Connect** · `/projects/<project>/emails/integrations/new/aws-ses`

The form is a wizard. First pick how to connect: **Cross-Account Role** ("Amazon recommended way") or **IAM User**.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-7258c246552e1de623f7750a09b8b856088f679b%2Faws-ses-1.png?alt=media" alt="New AWS SES Integration: How would you like to connect to AWS SES? with the Cross-Account Role and IAM User cards"><figcaption><p>Pick the connection type.</p></figcaption></figure>

With **IAM User**, three steps follow: **01 Create AWS Policy**, **02 Create IAM User**, **03 Connect**.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-fcf37e2cadf5c4fd81bf42169550ab0bea918e2b%2Faws-ses-2.png?alt=media" alt="IAM User picked; steps 01 Create AWS Policy, 02 Create IAM User, 03 Connect; Login to your AWS Management Console, AWS SES Identity (ARN)"><figcaption><p>Step 1: the policy.</p></figcaption></figure>

| Field                                                           | Step | Required | What it does                                                                                                                             | Example                                                      |
| --------------------------------------------------------------- | ---- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| AWS SES Identity (ARN)                                          | 1    | yes      | Your verified domain or address.                                                                                                         | `arn:aws:ses:eu-central-1:123456789012:identity/example.com` |
| AWS SES Region                                                  | 1    | yes      | The region of the identity.                                                                                                              | `Frankfurt (EU) eu-central-1`                                |
| AWS SES Configuration Set Name                                  | 1    | no       | An SES configuration set.                                                                                                                | `cs-for-acme`                                                |
| Create AWS Policy / Save policy                                 | 1    | —        | The form shows the policy JSON (send email on your identity only); save it in AWS as `ses-norbix-send-raw-email-policy`. Press **Next**. | —                                                            |
| Create IAM User, Attach policy, Save User, Download credentials | 2    | —        | Instructions: create the user `iam-norbix-user-for-ses`, attach the policy, create an access key. Press **Next**.                        | —                                                            |
| Sender Email Address                                            | 3    | yes      | Must belong to the verified identity.                                                                                                    | `no-reply@example.com`                                       |
| Sender Display Name                                             | 3    | no       | The "from" name.                                                                                                                         | `Acme`                                                       |
| Access key / Secret access key                                  | 3    | yes      | The IAM user's key pair. Stored encrypted, never shown again.                                                                            | `AKIA…`                                                      |
| Integration Name                                                | 3    | yes      | The name in Norbix.                                                                                                                      | `SES (example)`                                              |

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-d85814d613c19fe5f2d12d181854fdc90bfa0817%2Faws-ses-3.png?alt=media" alt="Step 2 Create IAM User: Create IAM User, Attach policy ses-norbix-send-raw-email-policy, Save User iam-norbix-user-for-ses, Download credentials, Press Next; Go Back and Next buttons"><figcaption><p>Step 2: the IAM user.</p></figcaption></figure>

With **Cross-Account Role**, the steps are **Create AWS Policy**, **Create Role** (opens the AWS console with Norbix's AWS account and your Norbix account id as the external id), **Attach policy**, **Save Role**, then the role ARN (`arn:aws:iam::123456789012:role/iam-norbix-access-role`). On an install outside AWS the wizard says this is not supported; use **IAM User**.

After **Save** the integration opens with its id and badges (**ENABLED**, **NOT TESTED**, **NOT CONFIRMED**):

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-f8b8bea086e929047f117951223695c95a9c557d%2Faws-ses-4.png?alt=media" alt="Editing AWS SES integration: badges ENABLED, NOT TESTED, NOT CONFIRMED, id int_5oBLNBjIKaqN7YpDuHdwOv, Identity ARN and Region Frankfurt (EU) eu-central-1"><figcaption><p>After save.</p></figcaption></figure>

## Test and set as default

On the saved integration: **Test Email Recipient** → **Test integration** → **I received it** ([Test an integration](/codemash/cloud/emails/integrations/test.md)); the DNS check shows **DKIM**, **SPF** and **DMARC** of your domain. Then **Actions → Set as default** if SES should send everything ([Set as default](/codemash/cloud/emails/integrations/set-default.md)). SES bounces and complaints do not come back into Norbix; watch them in AWS.

## Common errors

| Message                                            | Cause                                                         | Fix                                                        |
| -------------------------------------------------- | ------------------------------------------------------------- | ---------------------------------------------------------- |
| `AWS region is not provided` (`CM-ERRORS-AWS-001`) | No region in the request.                                     | Pick **AWS SES Region**; through the API send `awsRegion`. |
| The test passes, real recipients get nothing       | The account is in the SES sandbox.                            | Request production access in SES.                          |
| Test failed: SES refuses the sender                | The **Sender Email Address** is not on the verified identity. | Use an address on the verified domain.                     |
| Cross-account is not supported                     | Norbix runs outside AWS.                                      | Use **IAM User**.                                          |

## Do it from code

```ts
const { id } = await norbix.hub.notifications.saveEmailIntegration({
  integration: {
    provider: 'AwsSes',
    integrationType: 'Iam', // or 'CrossAccountRole' with roleArn + externalId
    integrationName: 'SES (example)',
    isEnabled: true,
    emailAddress: 'no-reply@example.com',
    emailSenderName: 'Acme',
    awsRegion: 'eu-central-1',
    emailIdentityArn: 'arn:aws:ses:eu-central-1:123456789012:identity/example.com',
    accessKey: process.env.AWS_ACCESS_KEY_ID ?? 'AKIAEXAMPLEEXAMPLE12',
    secretKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'made-up-secret',
  },
});
```

```sh
norbix hub notifications email integration get --id int_5oBLNBjIKaqN7YpDuHdwOv
```

API: [Save Email Integration](/codemash/api-reference/notifications/email/save-email-integration.md)