The **Edge stack** is an optional, opt-in piece of infrastructure that SendOps provisions in your AWS account. It installs a private S3 bucket and a CloudFront distribution that serve the images referenced by your email templates, and it underpins **managed (HTTPS) branded tracking domains**.

It is deployed as a **separate CloudFormation stack** from your core SendOps stack, so you can add or remove it at any time without touching your main connection. It reuses your existing SendOps IAM role — no new credentials are created — and attaches a scoped managed policy to that role granting access to the Edge resources it creates (see [Permissions the stack grants](#permissions-the-stack-grants) below).


  You can send email, sync templates, and use HTTP tracking domains without the Edge stack. You only need it if you want to host template images on your own CDN (the [Asset Library](/edge/asset-library)), serve those images from a [Custom Image Domain](/edge/custom-image-domain), or use managed HTTPS [Tracking Domains](/domains/tracking-domains).


## What it provisions

When the stack finishes deploying, it creates the following in your AWS account:

- A **private S3 bucket** that holds your content-addressed template images.
- A **CloudFront distribution** (the *assets distribution*) that serves those images publicly over HTTPS. Its domain looks like `d111111abcdef8.cloudfront.net`.
- A **tracking distribution** used by managed HTTPS tracking domains.

SendOps never stores AWS credentials for these — it assumes your existing SendOps role to read status and manage certificates.

## Permissions the stack grants

Rather than create new credentials, the Edge stack attaches a scoped managed policy (`SendOpsEdgeAccess`) to your existing `SendOpsRole`. Every action is restricted to the Edge resources the stack itself creates — the policy grants no access to any other bucket, distribution, or AWS service.

| Service | Permissions | Scope |
|---|---|---|
| **S3** | `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`, `s3:ListBucket` | The Edge assets bucket only — to promote, read, and prune your template images |
| **CloudFront** | `cloudfront:GetDistribution`, `cloudfront:GetDistributionConfig`, `cloudfront:UpdateDistribution` | The Edge assets and tracking distributions only — to read status and attach branded domains as alternate domain names |
| **ACM** | `acm:RequestCertificate`, `acm:DescribeCertificate`, `acm:DeleteCertificate`, `acm:ListCertificates`, `acm:AddTagsToCertificate` | Request, validate, and clean up the per-domain TLS certificates for [custom image](/edge/custom-image-domain) and managed [tracking](/domains/tracking-domains) domains |

The assets bucket itself stays fully private — only its CloudFront distribution can read it, via Origin Access Control (OAC, the AWS mechanism that lets a CloudFront distribution — and nothing else — read a private S3 bucket, so your images are never exposed by a public bucket URL). Removing the Edge stack removes this managed policy along with it.

## Enabling the Edge stack

In the [SendOps dashboard](https://app.sendops.dev), open **Infrastructure** in the sidebar and select the **Edge / CDN** tab.




  <Step title="Start the deployment">
    Click **Enable Edge stack**. SendOps opens the AWS CloudFormation **quick-create** console in a new tab, pre-filled with the Edge template.

    The launch URL also has a copy button next to it, so you can paste it into a different browser profile if the AWS account you want to deploy into is signed in elsewhere.
  </Step>

  <Step title="Deploy the stack in AWS">
    Review the stack in the AWS console and create it. CloudFront distributions take time to come online — **expect 15–25 minutes** before the stack is fully deployed.

    <Callout type="warning" title="Nothing happens automatically">
      SendOps does not poll AWS in the background. After the stack finishes deploying in AWS, you must return to SendOps and check the status to activate it.
    </Callout>
  </Step>

  <Step title="Check status to activate">
    Back on the Edge Stack page, click **Check status**. SendOps performs a single check against your AWS account. Once it sees the stack is complete, the page switches to the **active** state and shows your assets domain, distribution ID, S3 bucket, and template version.
  </Step>


## Status states

| Status | Meaning |
|--------|---------|
| **Not enabled** | No Edge stack exists yet for your AWS account. |
| **Provisioning** | The stack has been launched but isn't confirmed complete. Click **Check status** after deploying in AWS. |
| **Active** | The stack is deployed and serving. Your assets domain and bucket are shown. |
| **Drift** | The stack is active but its deployed template trails the latest version — an update is available (see below). |
| **Error** | The last deployment or check failed. The page shows the underlying AWS error and a **Retry** option. |

## Updating the Edge stack

When SendOps ships a newer Edge template, the page shows a **stack update** card with the version change (e.g. `v3 → v4`) and three ways to apply it:

- **AWS Console** — open CloudFormation, select the stack, choose *Replace current template*, and point it at the new template URL.
- **AWS CLI** — a ready-to-run `aws cloudformation update-stack` snippet.
- **Terraform** — an equivalent resource snippet.

After updating in AWS, click **Re-validate** so SendOps confirms the new version and clears the drift flag.


  Your core SendOps stack and the Edge stack both appear on the **AWS Stacks** page (open **Infrastructure** in the sidebar and select the **AWS Stacks** tab), where available updates for either stack are surfaced in one place.


## Disabling the Edge stack

On an active Edge stack, the **Disable Edge** action stops SendOps from tracking the stack. After disabling, your asset library will no longer be served from your CloudFront CDN.


  If any managed HTTPS [tracking domains](/domains/tracking-domains) depend on the Edge stack, you must remove them before you can disable it. SendOps blocks the disable while dependents exist.


Disabling in SendOps **does not delete your AWS resources**. To fully remove them and stop incurring CloudFront/S3 costs, delete the Edge CloudFormation stack from the AWS console in the region shown on the page.

## Who can manage it in SendOps

These are SendOps team roles (separate from the AWS IAM permissions [the stack grants](#permissions-the-stack-grants)):

| Permission | Capability |
|------------|------------|
| `aws.edge.view` | View the Edge stack status and asset library. |
| `aws.edge.manage` | Enable, check, update, and disable the Edge stack; manage custom image domains. |

Members without `aws.edge.manage` see the page in read-only mode.

## What's next?

- [Asset Library & Images](/edge/asset-library) — reference repository images in your templates and serve them from the Edge CDN.
- [Custom Image Domain](/edge/custom-image-domain) — serve template images from your own branded subdomain.
- [Tracking Domains](/domains/tracking-domains) — use the Edge stack for managed HTTPS tracking.