Create IAM credentials for SES

EonMailer sends mail through SES using an IAM access key pair (Access Key ID + Secret Access Key) scoped to sending and configuration read access. Never paste root account keys into EonMailer or email them in plain text.

Recommended approach: dedicated IAM user per client

Create one IAM user per client workspace, e.g. eonmailer-client-acme, so you can rotate or revoke keys without touching other clients.

Step 1 — Create the IAM user

1. AWS Console → IAM → Users → Create user.
2. User name: eonmailer-ses-acme (include client slug).
3. Do not enable console access unless an human needs to sign in — programmatic access only is fine.
4. Click Next.

Step 2 — Attach permissions

You have two options:

Option A — AWS managed policy (fastest)

Attach AmazonSESFullAccess. This is broader than ideal but common for small teams.

Warning Full access includes deleting identities. Restrict to Option B when your security team requires least privilege.

Option B — Custom inline policy (recommended)

Create a customer-managed policy named EonMailerSESAccess:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SendAndIdentity",
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetAccount",
        "ses:GetSendQuota",
        "ses:ListIdentities",
        "ses:GetIdentityVerificationAttributes",
        "ses:GetIdentityDkimAttributes",
        "ses:VerifyDomainIdentity",
        "ses:VerifyEmailIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Adjust actions if EonMailer needs configuration set management in your plan tier — check the in-app provider setup panel for the exact list.

Attach the policy to the user and continue.

Step 3 — Create access keys

1. Open the new user → Security credentials tab.
2. Under Access keys, choose Create access key.
3. Use case: Application running outside AWS (or Other).
4. Copy the Access key ID and Secret access key immediately.

Important The secret is shown once. Store both values in your password manager before closing the dialog.

Step 4 — Store secrets safely

• Do store in 1Password / Bitwarden / AWS Secrets Manager with client label and region.
• Do note creation date and who rotated last.
• Don’t commit keys to Git, Slack, or ticket attachments.
• Don’t reuse the same key across staging and production.

Step 5 — Optional: restrict by condition (advanced)

For large agencies, add IAM conditions limiting sends to verified identities:

"Condition": {
  "StringLike": {
    "ses:FromAddress": ["*@mail.client.com"]
  }
}

Requires your From addresses stay on that domain — align with DNS verification.

Step 6 — Rotation policy

Rotate keys every 90–180 days or immediately if exposed:

1. Create a second access key on the user (AWS allows two active keys).
2. Update EonMailer provider settings with the new secret.
3. Send test mail.
4. Deactivate and delete the old key.

Document the rotation in your client change log.

Troubleshooting credential errors

Symptom	Likely cause
InvalidClientTokenId	Wrong key ID or deleted key
SignatureDoesNotMatch	Secret copied with trailing space
AccessDenied on SendEmail	Policy missing ses:SendEmail
Works in console test but not EonMailer	Region mismatch vs SES identity region

See Troubleshoot Amazon SES in EonMailer for connection-level debugging.

Next step

Connect Amazon SES to EonMailer with the region and keys you just created.