Setup guide

Connect your SES in about five minutes

Two modes: let TrackSES wire everything automatically with a scoped IAM user key, or provision the AWS resources yourself and share nothing. Either way, deliverability monitoring works the moment you connect.

Least-privilege: read-only on your data, never ses:Send*

SES events

SNS topic

TrackSES

Paste a scoped AWS IAM user access key and TrackSES handles the rest. It creates a dedicated SNS topic and SES configuration set, then points your connected identities at them in seconds. One SES region per project, so pick the region your sending runs in.

Create a scoped IAM user

In the AWS IAM console, create a new user (not a role) and attach the least-privilege policy below. TrackSES is read-only on your data; the only things it writes are its own SNS event destination trackses-* and a default configuration set on the identities you connect; your other destinations are never touched.

trackses-iam-policy.jsonleast-privilege

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TrackSESReadDomains", /* read-only on your data */
      "Effect": "Allow",
      "Action": [
        "ses:ListEmailIdentities", "ses:GetEmailIdentity",
        "ses:ListConfigurationSets", "ses:GetConfigurationSetEventDestinations",
        "ses:GetIdentityNotificationAttributes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TrackSESConfigSets",
      "Effect": "Allow",
      "Action": [ "ses:CreateConfigurationSet", "ses:DeleteConfigurationSet" ],
      "Resource": "arn:aws:ses:*:*:configuration-set/trackses-*"
    },
    {
      "Sid": "TrackSESWireEventDestination", /* add/remove only OUR destination */
      "Effect": "Allow",
      "Action": [
        "ses:CreateConfigurationSetEventDestination",
        "ses:UpdateConfigurationSetEventDestination",
        "ses:DeleteConfigurationSetEventDestination"
      ],
      "Resource": "arn:aws:ses:*:*:configuration-set/*"
    },
    {
      "Sid": "TrackSESAttachConfigSet",
      "Effect": "Allow",
      "Action": [ "ses:PutEmailIdentityConfigurationSetAttributes" ],
      "Resource": [ "arn:aws:ses:*:*:identity/*", "arn:aws:ses:*:*:configuration-set/*" ]
    },
    {
      "Sid": "TrackSESEventPipe",
      "Effect": "Allow",
      "Action": [
        "sns:CreateTopic", "sns:Subscribe", "sns:Unsubscribe",
        "sns:SetTopicAttributes", "sns:GetTopicAttributes",
        "sns:ListSubscriptionsByTopic", "sns:DeleteTopic"
      ],
      "Resource": "arn:aws:sns:*:*:trackses-*"
    },
    {
      "Sid": "TrackSESListTopics", /* list only, cleanup on disconnect */
      "Effect": "Allow",
      "Action": [ "sns:ListTopics" ],
      "Resource": "*"
    },
    {
      "Sid": "TrackSESIdentityNotifications", /* optional catch-all */
      "Effect": "Allow",
      "Action": [ "ses:SetIdentityNotificationTopic" ],
      "Resource": "arn:aws:ses:*:*:identity/*"
    }
  ] /* never ses:Send* */
}

Paste the access key into TrackSES

Copy the access key ID and secret. In your TrackSES project settings, paste them under AWS credentials. Keys are stored AES-256-GCM encrypted and never logged.

AES-256-GCM encrypted at rest

TrackSES wires everything

TrackSES creates the SNS topic and its configuration set, subscribes the webhook, and adds its event destination to your connected identities, without removing any of your existing destinations.

SNS topic created Config set created Webhook subscribed Domains attached

Live events start flowing

Deliverability events (deliveries, bounces and complaints) stream into your dashboard the moment you connect. Open and click tracking is supported too. Amazon SES only adds it when an email references a configuration set, so TrackSES guides you to switch it on.

Prefer to keep AWS access entirely on your side? In Autonomous mode you provision the resources yourself and TrackSES stores no credentials. You just point AWS at your TrackSES webhook. Here's the idea at a glance; the exact values and guided steps appear inside the app once you sign up.

You provision the AWS resources

On your own account you create the SNS topic and SES configuration set that carry your events. The easiest path is a one-click CloudFormation stack that provisions them for you with no credentials shared. You can also set them up by hand from the AWS Console (web UI) or the AWS CLI.

You point them at your TrackSES webhook

Subscribe your topic to the secure webhook endpoint TrackSES gives you, and set the configuration set on the identities you want monitored. No access key ever leaves your account.

TrackSES hands you the exact values

After you sign up, your project shows the precise endpoint URL, resource names and a step-by-step checklist for both the Console and the CLI, so you copy real values instead of guessing.

Your live stream is ready

TrackSES confirms the subscription and pins the topic automatically, then deliverability events start flowing, with no credentials ever leaving your account.

We keep the exact commands, resource names and endpoint URLs inside your account, so your capture pipeline stays yours. Sign up to get the guided autonomous walkthrough.

IAM permission scope

Exactly what the key can access

In Automatic mode the IAM user receives a single least-privilege inline policy. SES read access is account-wide so TrackSES can list your identities and configuration sets; everything it creates is prefixed trackses-* . The only writes on your resources are adding TrackSES's own event destination and a default configuration set, never ses:Send*.

SNS: scoped to

arn:aws:sns:*:*:trackses-*

allowed · scoped

sns:CreateTopic

sns:Subscribe

sns:Unsubscribe

sns:SetTopicAttributes

sns:GetTopicAttributes

sns:ListSubscriptionsByTopic

sns:ListTopics

sns:DeleteTopic

SES: read + wire our events

read-only + our event destination

allowed · scoped

ses:ListEmailIdentities

ses:GetEmailIdentity

ses:ListConfigurationSets

ses:GetConfigurationSetEventDestinations

ses:GetIdentityNotificationAttributes

ses:CreateConfigurationSet

ses:DeleteConfigurationSet

ses:CreateConfigurationSetEventDestination

ses:UpdateConfigurationSetEventDestination

ses:DeleteConfigurationSetEventDestination

ses:PutEmailIdentityConfigurationSetAttributes

ses:SetIdentityNotificationTopic

Never granted

in either mode

never

ses:Send*

ses:SendEmail

ses:SendRawEmail

ses:SendBulkEmail

ses:UpdateAccountSendingEnabled

ses:DeleteIdentity

Security model

What TrackSES can and cannot do

Can do

Read your sending identities and configuration sets so it can wire capture for you

Create dedicated trackses-* SNS topics and configuration sets, and add its own SNS event destination to your configuration sets

Set a default configuration set on the identities you connect, and capture SES event notifications (delivered, bounced, complaint, opened, clicked) via the SNS topic

Cannot do

Send email on your behalf: ses:Send* is never requested or granted, in either mode

Read message bodies, contact lists, or any content of the emails you send

Remove or alter your existing event destinations: it only adds its own, and disconnecting removes every trace it created

Ready to see your SES events live?

Start 14-day free trial View pricing