When you [connect your AWS account](/aws-setup/connecting-aws), SendOps deploys a CloudFormation stack that creates an IAM role, an SES configuration set, EventBridge rules, and a webhook integration. The IAM role defines exactly what actions SendOps can perform in your AWS account. This page documents every permission in that role so your security and infrastructure teams can review them before granting access.


  SendOps only requests permissions it actively uses. The core IAM role policy is scoped to SES v2, EventBridge read-only, and read-only CloudFormation (stack discovery) actions — the core role has no access to S3, EC2, Lambda, or any other AWS service. EventBridge rules, API destinations, and connections are created by the CloudFormation stack itself, not by the IAM role. (The optional [Edge / CDN stack](/edge/edge-stack), if you enable it, attaches a separate scoped policy that adds access to *its own* S3 bucket, CloudFront distributions, and ACM certificates — see [Edge Stack](/edge/edge-stack#permissions-the-stack-grants).)


## SES permissions — read-only

These permissions allow SendOps to read your SES account status, identities, configuration sets, and templates. They do not modify any resources.

| Permission | Description | Why SendOps needs it |
|---|---|---|
| `ses:GetAccount` | Read account-level sending limits, enforcement status, and DKIM settings | Displays your account health and sending limits on the dashboard |
| `ses:GetSendQuota` | Read the current sending quota and how much has been used in the last 24 hours | Powers the sending quota widget and quota-based alerts |
| `ses:GetSendStatistics` | Read aggregate sending statistics (sends, bounces, complaints, rejects) | Feeds the deliverability overview charts |
| `ses:ListEmailIdentities` | List all verified domains and email addresses (SES v2) | Populates the Identities page in SendOps |
| `ses:GetEmailIdentity` | Read verification status, DKIM attributes, MAIL FROM configuration, and notification settings for a domain or email address (SES v2) | Shows verification status, DKIM configuration, and MAIL FROM status on identity detail pages |
| `ses:ListConfigurationSets` | List all SES configuration sets | Verifies the `sendops-events` configuration set exists |
| `ses:GetConfigurationSet` | Read configuration set details including tracking, reputation, sending, delivery, and suppression options (SES v2) | Confirms the configuration set is correctly configured |
| `ses:GetEmailTemplate` | Read template subject, HTML body, and text body (SES v2) | Displays template content for preview and version comparison |
| `ses:ListEmailTemplates` | List all SES email templates (SES v2) | Populates the Templates section in SendOps |
| `ses:ListSuppressedDestinations` | List email addresses on the account-level suppression list | Displays suppressed addresses so you can review and manage them |
| `ses:ListContactLists` | List SES contact lists in the account (SES v2) | Discovers the contact list used for subscription management |
| `ses:GetContactList` | Read a contact list's name, description, and topics (SES v2) | Syncs topics between SES and SendOps |
| `ses:ListContacts` | List contacts in a contact list (SES v2) | Syncs contacts and their subscription state into SendOps |
| `ses:GetContact` | Read a contact's attributes and topic preferences (SES v2) | Shows per-contact subscription preferences in SendOps |

## SES permissions — write and management

These permissions allow SendOps to create, update, and delete SES resources on your behalf. They power domain onboarding, configuration set management, suppression list management, and template management.

| Permission | Description | Why SendOps needs it |
|---|---|---|
| `ses:CreateEmailIdentity` | Create a new email identity (domain or email address), initiating verification and DKIM setup (SES v2) | Starts the domain or email verification workflow from the SendOps dashboard |
| `ses:DeleteEmailIdentity` | Remove a verified domain or email address (SES v2) | Lets you clean up identities you no longer use |
| `ses:PutEmailIdentityConfigurationSetAttributes` | Associate or disassociate a configuration set with an email identity | Links identities to the `sendops-events` configuration set for event tracking |
| `ses:CreateConfigurationSet` | Create a new SES configuration set | Creates the `sendops-events` configuration set if it does not exist |
| `ses:DeleteConfigurationSet` | Delete a configuration set | Removes configuration sets during cleanup or reconfiguration |
| `ses:PutConfigurationSetTrackingOptions` | Set custom redirect domain for open and click tracking on a configuration set | Configures tracking domains for open and click tracking |
| `ses:PutConfigurationSetReputationOptions` | Enable or disable reputation metrics on a configuration set | Enables reputation monitoring for SendOps-managed configuration sets |
| `ses:PutConfigurationSetSendingOptions` | Enable or disable sending on a configuration set | Controls whether a configuration set is active for sending |
| `ses:PutConfigurationSetDeliveryOptions` | Set TLS policy and sending pool on a configuration set | Configures delivery options like TLS enforcement |
| `ses:PutConfigurationSetSuppressionOptions` | Configure suppression list behavior on a configuration set | Controls how bounces and complaints are handled at the configuration set level |
| `ses:CreateConfigurationSetEventDestination` | Add an event destination to a configuration set | Routes SES events to EventBridge for the SendOps pipeline |
| `ses:GetConfigurationSetEventDestinations` | Read the event destinations attached to a configuration set | Lets SendOps verify event routing during sync and detect configuration drift |
| `ses:UpdateConfigurationSetEventDestination` | Update an existing event destination | Modifies event routing when configuration changes |
| `ses:DeleteConfigurationSetEventDestination` | Remove an event destination from a configuration set | Cleans up event destinations during reconfiguration |
| `ses:CreateEmailTemplate` | Create a new email template (SES v2) | Powers template creation from the SendOps dashboard or GitHub sync |
| `ses:UpdateEmailTemplate` | Update an existing template's subject, HTML, or text body (SES v2) | Powers template editing and version promotion |
| `ses:DeleteEmailTemplate` | Delete an email template (SES v2) | Lets you remove templates you no longer need |
| `ses:TagResource` | Add tags to SES resources | Tags resources created by SendOps for identification and organization |
| `ses:UntagResource` | Remove tags from SES resources | Manages tags on SendOps-created resources |
| `ses:DeleteSuppressedDestination` | Remove an email address from the account-level suppression list | Lets you unsuppress addresses that were previously bounced or complained |
| `ses:PutAccountDetails` | Submit account details to AWS, including the production access request (SES v2) | Lets you request SES production access (leave the sandbox) from the SendOps dashboard |
| `ses:CreateContactList` | Create the SES contact list SendOps uses for subscription management (SES v2) | Provisions the `sendops-contacts` contact list on demand when you add your first contact, so you don't need a pre-existing list |
| `ses:UpdateContactList` | Update a contact list's topics and description (SES v2) | Keeps SES topics in sync when you edit them in SendOps |
| `ses:CreateContact` | Add a contact to a contact list (SES v2) | Adds contacts created or imported in SendOps to your SES contact list |
| `ses:UpdateContact` | Update a contact's attributes and topic preferences (SES v2) | Applies subscription preference changes made in SendOps |
| `ses:DeleteContact` | Remove a contact from a contact list (SES v2) | Removes contacts you delete in SendOps |

## SES permissions — sending

| Permission | Description | Why SendOps needs it |
|---|---|---|
| `ses:SendEmail` | Send an email via the SES v2 API (supports simple, raw, and templated formats) | Used for the onboarding test send that verifies the integration works end-to-end |
| `ses:SendBulkEmail` | Send a templated email to many recipients in a single SES v2 call | Reserved for **broadcasts** — sending a campaign to your Lists & Segments |
| `ses:SendBulkTemplatedEmail` | Send a templated email to many recipients via the SES classic (v1) bulk API | Granted alongside `ses:SendBulkEmail` so broadcasts work regardless of which SES API version handles the send |


  Today, SendOps uses `ses:SendEmail` to send the initial test email during onboarding, which verifies that the integration is working end-to-end. The bulk-send permissions (`ses:SendBulkEmail` and `ses:SendBulkTemplatedEmail`) are granted ahead of **broadcasts** — sending a campaign to your Lists & Segments — so you grant sending permission **once** rather than having to re-deploy your stack when broadcasts arrive. SendOps only ever sends email you explicitly trigger (an onboarding test send, or a broadcast you create) — it never sends on its own, and it cannot send email outside your account.


## EventBridge permissions — read-only

These permissions allow SendOps to verify that the EventBridge rule and targets created by the CloudFormation stack are correctly configured. SendOps does **not** have permission to create or modify EventBridge rules — those resources are managed by the CloudFormation stack.

| Permission | Description | Why SendOps needs it |
|---|---|---|
| `events:DescribeRule` | Read the details of an EventBridge rule | Verifies the `sendops-ses-events` rule exists and is enabled |
| `events:ListTargetsByRule` | List targets attached to an EventBridge rule | Confirms the rule is routing events to the SendOps API destination |

## CloudFormation permissions — stack discovery

These read-only permissions let SendOps locate the CloudFormation stacks in your account — in particular the optional [Edge / CDN stack](/edge/edge-stack), which you can deploy (and rename) at any time. They grant **no** ability to create, update, or delete any stack.

| Permission | Description | Why SendOps needs it |
|---|---|---|
| `cloudformation:ListStacks` | List the CloudFormation stacks in the account and region | Finds the Edge stack by its outputs even if you renamed it in the quick-create console |
| `cloudformation:DescribeStacks` | Read a stack's status and outputs | Polls Edge provisioning to completion and reads back the bucket and distribution details |

## Removing unused permissions

If you do not plan to use certain SendOps features, you can remove the corresponding permissions from the policy:

- **Not managing templates through SendOps?** Remove `ses:CreateEmailTemplate`, `ses:UpdateEmailTemplate`, `ses:DeleteEmailTemplate`.
- **Only using SendOps for monitoring and reporting?** If you have completed onboarding and don't plan to send broadcasts to your Lists & Segments from SendOps, you can remove `ses:SendEmail`, `ses:SendBulkEmail`, and `ses:SendBulkTemplatedEmail`. The bulk-send actions are only used for broadcasts.
- **Not managing identities through SendOps?** Remove `ses:CreateEmailIdentity` and `ses:DeleteEmailIdentity`.
- **Not managing the suppression list through SendOps?** Remove `ses:DeleteSuppressedDestination`.


  The read-only SES permissions and EventBridge permissions are required for core SendOps functionality (dashboards, alerts, and event pipeline verification). Removing them will break the connection.



  For more on securing cross-account access, see the [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) documentation. SendOps aligns with these recommendations by using external IDs, temporary credentials via STS, and scoped policies.


## Related pages

- [AWS Integration](/aws-setup/connecting-aws) — create the IAM role and deploy the CloudFormation stack
- [Supported AWS Regions](/aws-setup/supported-regions) — regions where these permissions apply