# Amazon SES

![Image 1 of 1](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535433117325.png)
Amazon Simple Email Service (SES) is Amazon's Web Services (AWS) cloud-based email service. With it you can send transactional email, marketing messages, or any other type of high-quality content to your customers.

In order to integrate Amazon SES with Relyance AI you will need create a custom SES role, and establish a trust relationship with Relyance's service account, and provide the **Role ARN**, **External ID**, and **Region** to Relyance.

#### In Amazon SES:

1. Login to your Amazon account.
2. To to the **IAM** console and select **Roles** from the left-hand navigation menu.
3. Click the **Create role** button.
4. Select **AWS account** for the **Trusted entity type**.
5. Click **Next**.
6. In the **Add permissions** screen you'll want to find the appropriate policy:

7. Click **Next**.
8. In the final step, provide a meaningful **Role name** (eg. RelyanceSESReadOnly) and click the **Create role** button.
9. Create an **External ID** - this can be anything. (e.g. '9599ec49-abb3-47bb-a5b6-86c79fc10d32') The external ID is a secret that you will use and enter in the Relyance platform for additional security. While it could be anything, we recommend using a secret generator such as [https://www.uuidgenerator.net/version4](https://www.uuidgenerator.net/version4) to generate.
10. Once created, edit the new role and select the **Trust relationships** tab.
11. Update the trust policy to use the Relyance service account. Click the **Edit trust policy** button and update the policy accordingly:
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<< external ID >>"
        }
      }
    }
  ]
}
```
Ensure you replace '<< external ID >>' with the external ID you created previously. The line with "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access" grants permission to the Relyance Service Account access to the resources associated with this role.
12. Copy this **Role ARN** to to be used in Relyance.

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Amazon SES** integration card and click on it.
5. Click on the **Add Connection** button on the top right
6. Provide a meaningful name for the integration and click on the **Add** button
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/)
8. In the **Connection** section, provide the appropriate values and click on **Continue**,

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535433117581.png)
![Screenshot](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535417467149.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535433117965.png)

9. In the Authentication section, Choose **SES Assume-Role** under **Authentication Method**., then provide the **SES Role ARN**, **External ID**, and **Region** (defaults to `us-east-1`) into their respective fields
10. If the Data Inspection check box is checked from step 7, In the Data Inspection section, provide the appropriate values and click on **Continue** **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535433118221.png)

11. Review the configuration summary from the Completion section and click on Finish.
12. Confirm the integration Status reflects Connected

![Screenshot](https://assets.relyanceuat.xyz/images/docs/34535433120269/34535417469453.png)

### Verify the connection is really working

Discovery reads the account's identities and templates:
`ses:ListIdentities`, `ses:ListVerifiedEmailAddresses` and
`ses:ListCustomVerificationEmailTemplates`. **AmazonSESReadOnlyAccess** covers
them, and the Terraform module at the end of this page grants the three explicitly.

1. **A failure at Authenticate** is the trust policy or the external ID.
2. **Connected but nothing discovered.** SES is regional and the sandbox is per
   region: an account whose identities live in a different region from the one on
   the connection returns an empty list rather than an error.
3. **Data subject requests need more than read access.** The DSR feature reads and
   deletes contacts in contact lists, so it requires write access
   (`AmazonSESFullAccess` covers it) — the read-only policy above is enough for
   discovery only. Grant the wider policy only if you enable that feature.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "aws_ses" {
  vendor = "aws_ses"
  name   = "<your connection name>"

  auth = {
    method = "iam-role"
    params = {
      vendor_role_arn = "<vendor_role_arn>"
      region = "us-east-1"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_ses_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->