Connecting Amazon SES

Sendra sends email through your own Amazon SES account. This gives you full control over your sending infrastructure and means Amazon bills you directly for delivery at its own rates — typically $0.10 per 1,000 emails — with no markup from Sendra.

The onboarding wizard walks you through every step below with screenshots, and the white-glove option can do it all for you. This page is the reference if you'd rather set it up by hand, or you're reconnecting later from Settings → AWS.

Create the IAM user

You'll create a dedicated IAM user whose only job is to send mail. Sendra stores its access keys encrypted, scoped to your workspace.

1. Open the IAM Console → Users in AWS.
2. Click Create user and name it sendra-mailer. Leave Provide user access to the AWS Management Console unchecked — Sendra only needs API access.
3. On the Permissions step, choose Attach policies directly and check both:
   • AmazonSESFullAccess — lets Sendra send mail and manage sending identities.
   • AmazonSNSFullAccess — lets Sendra wire up SNS so bounces and complaints are tracked automatically.
4. Click Create user.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SendraSES",
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:GetAccount",
        "ses:PutAccountDetails",
        "ses:CreateEmailIdentity",
        "ses:GetEmailIdentity",
        "ses:ListEmailIdentities",
        "ses:DeleteEmailIdentity",
        "ses:PutAccountSendingAttributes",
        "ses:CreateConfigurationSet",
        "ses:GetConfigurationSet",
        "ses:CreateConfigurationSetEventDestination",
        "ses:GetConfigurationSetEventDestinations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SendraFeedbackTopic",
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic",
        "sns:Subscribe",
        "sns:GetTopicAttributes",
        "sns:SetTopicAttributes",
        "sns:ListSubscriptionsByTopic"
      ],
      "Resource": "arn:aws:sns:*:*:sendra-ses-feedback"
    },
    {
      "Sid": "SendraIdentity",
      "Effect": "Allow",
      "Action": ["sts:GetCallerIdentity"],
      "Resource": "*"
    }
  ]
}

Create an access key

1. Open the sendra-mailer user, then the Security credentials tab.
2. Scroll to Access keys and click Create access key.
3. Choose Application running outside AWS, then Next and Create access key.
4. Copy both the Access key ID and the Secret access key — AWS only shows the secret once.

Paste your keys into Sendra

Back in Sendra (onboarding, or Settings → AWS), paste the Access Key ID and Secret Access Key and pick your AWS region. Sendra defaults to us-east-1; if your SES identities already live in another region, Sendra auto-detects it and switches for you.

After you save, Sendra runs a live test to confirm the credentials work. You'll see a success confirmation, or a specific error if something's off:

Finish SES setup & verify your sender

The first time you open the SES console you may hit a one-time "Get set up" screen — that part lives on AWS's side and can't be automated. You can safely skip the upsells it offers:

• Dedicated IPs / Virtual Deliverability Manager — not needed. Sendra creates the configuration set for bounce & complaint tracking automatically.
• DKIM records for your domain — Sendra generates these for you during domain verification.
• Production access — request it later in one click from Sending Health.

Then verify the address you'll send from. AWS emails that address a one-time confirmation link; click it and you're done. While your account is in the SES sandbox you can only send to and from verified addresses, so verifying one sender up front is what lets your first test send go through. You can also verify identities directly in the SES Verified identities console.

Where credentials are stored

Credentials you enter are stored encrypted, scoped to your workspace. Each workspace can connect a different AWS account, so agencies and multi-brand teams keep sending fully isolated.

Region

SES is region-specific. Sendra defaults to us-east-1. If your SES lives in a different region, set it when you paste your keys (Sendra also auto-detects it from your existing identities).