Amazon SES

Amazon Simple Email Service (SES) is a cost-effective email service built on AWS infrastructure.

Prerequisites

Before configuring SES in Notiflows, you need:

1. An AWS account
2. A verified sending identity (domain or email address)
3. An IAM user with SES send permissions
4. SES moved out of sandbox mode if you need to send to unverified recipients

Configuration

Step 1: Verify a sender identity

SES requires you to verify the domain or email address you send from. Domain verification is recommended for production because it covers all addresses on that domain.

Option A: Verify a domain (recommended)

1. Open the Amazon SES console
2. In the left navigation, under Configuration, click Identities
3. Click Create identity
4. Select Domain as the identity type
5. Enter your domain (e.g., example.com)
6. Under Verifying your domain, leave Easy DKIM selected and choose RSA_2048_BIT as the signing key length
7. Click Create identity

SES generates three CNAME records for DKIM authentication. You need to add these to your domain's DNS:

1. On the identity details page, click the Authentication tab
2. Expand Publish DNS records — you'll see three CNAME records
3. Add each record to your DNS provider (or click Download .csv record set to export them)
4. Wait for DNS propagation — the Identity status changes to Verified once SES detects the records (usually a few minutes, can take up to 72 hours)

Option B: Verify an email address

Use this for quick testing or if you don't own the sending domain.

1. Open the Amazon SES console
2. In the left navigation, under Configuration, click Identities
3. Click Create identity
4. Select Email address as the identity type
5. Enter the email address you want to send from
6. Click Create identity
7. Check your inbox for an email from no-reply-aws@amazon.com and click the verification link

The identity status updates to Verified within a few minutes.

Step 2: Move out of sandbox mode

New SES accounts start in sandbox mode, which limits sending to verified email addresses only. For production use, you need to request production access.

1. Open the Amazon SES console
2. In the left navigation, click Account dashboard
3. At the top you'll see a banner: "Your Amazon SES account is in the sandbox"
4. Click View Get set up page, then Request production access
5. Fill in the form:
   • Mail Type — select Transactional
   • Website URL — your application's URL
   • Additional Contacts — email addresses for account communications
   • Acknowledge that you'll only send to recipients who have opted in and that you handle bounces and complaints
6. Click Submit request

AWS typically responds within 24 hours.

Step 3: Create an IAM user

Notiflows needs an IAM access key with permission to send email through SES. Create a dedicated IAM user rather than using root account credentials.

Create the IAM policy

1. Open the IAM console
2. In the left navigation, click Policies
3. Click Create policy
4. Click the JSON tab and paste the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}

5. Click Next
6. Name the policy (e.g., NotiflowsSESSendEmail)
7. Click Create policy

To restrict sending to a specific verified identity, replace "Resource": "*" with your identity ARN:

"Resource": "arn:aws:ses:us-east-1:123456789012:identity/example.com"

You can find your identity ARN on the identity details page in the SES console.

Create the user and attach the policy

1. In the IAM console, click Users in the left navigation
2. Click Create user
3. Enter a user name (e.g., notiflows-ses)
4. Do not check "Provide user access to the AWS Management Console" — Notiflows only needs programmatic access
5. Click Next
6. Select Attach policies directly
7. Search for the policy you created (NotiflowsSESSendEmail) and check it
8. Click Next, then Create user

Generate access keys

1. Click on the user you just created to open the user details
2. Go to the Security credentials tab
3. Scroll to Access keys and click Create access key
4. Select Third-party service as the use case
5. Check the acknowledgment and click Next, then Create access key
6. Copy the Access Key ID and Secret Access Key

Step 4: Choose a region

SES is a regional service. The region you choose in Notiflows must match the region where your verified identities are configured. Pick the region closest to your users for lower latency.

Step 5: Set up in Notiflows

1. Navigate to Channels in your project
2. Click Create Channel
3. Select Email as the channel type
4. Select Amazon SES as the provider
5. Select your Region
6. Enter your IAM Access Key ID and Secret Access Key
7. Enter your verified From Email and optionally a From Name
8. Save the channel

Templates

Email templates support three content types:

• Visual - Drag-and-drop editor for rich HTML emails
• HTML - Raw HTML with full control
• Plaintext - Simple text emails

Use Liquid templating for dynamic content:

Hi {{ recipient.first_name }},

{{ data.message }}

Best,
{{ actor.first_name }}

Available variable contexts:

• recipient.* - Recipient user data (first_name, last_name, email, etc.)
• actor.* - User who triggered the notification
• data.* - Custom payload passed when triggering the notiflow