EmailIdentityPolicy

Source: src/AWS/SES/EmailIdentityPolicy.ts

An Amazon SES v2 sending-authorization policy attached to an email identity — lets the identity owner authorize other AWS accounts or IAM principals to send email using the identity.

SES stores the policy document as JSON; Alchemy serializes the typed IAM policy at the API boundary and compares its normalized content for drift.

Attaching a Policy

Authorize Another Account to Send

import * as SES from "alchemy/AWS/SES";

const identity = yield* SES.EmailIdentity("Sender", {
  emailIdentity: "mail.example.com",
});

const policy = yield* SES.EmailIdentityPolicy("AllowPartner", {
  emailIdentity: identity.emailIdentity,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::111122223333:root" },
        Action: ["ses:SendEmail"],
        Resource: identity.identityArn,
      },
    ],
  },
});

Explicit Policy Name

// Without policyName a deterministic name is derived from app/stage/id.
const policy = yield* SES.EmailIdentityPolicy("AllowPartner", {
  emailIdentity: identity.emailIdentity,
  policyName: "partner-send",
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::111122223333:root" },
        Action: ["ses:SendEmail"],
        Resource: identity.identityArn,
      },
    ],
  },
});

Restrict the Grant with Conditions

const policy = yield* SES.EmailIdentityPolicy("AllowPartnerScoped", {
  emailIdentity: identity.emailIdentity,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::111122223333:root" },
        Action: ["ses:SendEmail", "ses:SendRawEmail"],
        Resource: identity.identityArn,
        Condition: {
          StringEquals: { "ses:FromAddress": "noreply@mail.example.com" },
        },
      },
    ],
  },
});

Several Policies on One Identity

// Each policy is a separate resource keyed by its own name.
for (const partner of ["111122223333", "444455556666"]) {
  yield* SES.EmailIdentityPolicy(`Allow${partner}`, {
    emailIdentity: identity.emailIdentity,
    policyName: `partner-${partner}`,
    policy: {
      Version: "2012-10-17",
      Statement: [
        {
          Effect: "Allow",
          Principal: { AWS: `arn:aws:iam::${partner}:root` },
          Action: ["ses:SendEmail"],
          Resource: identity.identityArn,
        },
      ],
    },
  });
}