## Capabilities

DataGrail's AWS SES integration provides the following capabilities:

| Product | Capability |
| --- | --- |
| [Request Manager](https://docs.datagrail.io/docs/request-manager/getting-started) | | Foundation Connections | Transactional Mailer | |

## Before You Start

To successfully configure this integration, please ensure you have sufficient privileges:

- **DataGrail User Role:** Super Admin, Connections Manager
- **AWS SES User Role:** Admin

## Create a Sender Identity

To utilize SES as your transactional mailer, you must have a verified Sender Identity in the `us-east-1` or `us-west-2` regions.

1. Confirm with your privacy team the domain and email address that will be used to send privacy communications to Consumers/Data Subjects.
2. Navigate to **Amazon Simple Email Service**.
3. Select **Identities** from the **Configuration** section in the left-hand menu.
4. Select **Create Identity**.
5. Based on your preference, select either **Domain** or **Email** under **Identity type**.
6. Following AWS' instructions, verify the newly created identity: [Creating and verifying identities in Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html#just-verify-domain-proc).

> The sender identity associated with the transactional mailer email address must show a verified status before proceeding with the remaining DataGrail setup. As the [delegate sender](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-authorization-overview.html), we do not control the DKIM keys. We recommend identity owners configure these using [AWS Easy DKIM](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-dkim-easy.html).

## Create an Identity Policy

1. Select the Sender Identity you created in [Create a Sender Identity](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#create-a-sender-identity).
2. Select the **Authorization Menu** and **Use Policy Generator**.
3. Enter the **Principal** that should be issued the permissions:
   - For [AssumeRole Connections](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#connect-with-assumerole-recommended), add the ARN of the IAM Role.
   - For [Access Key Connections](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#connect-with-an-access-key), add the `338780525468` (DataGrail Account ID).
4. Under **Actions**, select `ses:SendEmail` and `ses:SendRawEmail`.
5. (Optional) Expand the **Specify conditions** menu and create the following rule:

Restrict SES 'From' Address

- **Operator**: `StringEquals`
   - **Key**: `ses:FromAddress`
   - **Value**: The email address you wish to use with your transactional mailer.

6. Select **Next** and create the Policy.

## Connect to DataGrail

DataGrail provides two methods for securely connecting AWS SES:

- [Using AssumeRole (Recommended)](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#connect-with-assumerole-recommended)
- [Using an Access Key](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#connect-with-an-access-key)

One of the main security benefits of using AssumeRole is the lack of key rotation requirements. Read more about IAM Users and Roles [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html).

### Connect With AssumeRole (Recommended)

#### Create The IAM Role

1. Navigate to **IAM** within AWS and select **Roles** from the left menu.
2. Select **Create Role**.
3. Choose **Custom trust policy**.
4. Enter the **Recommended JSON Policy**, ensuring you create and substitute an **External ID**.

**Recommended JSON Policy**

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::338780525468:user/dg_app"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "SUBSTITUTEME"
                }
            }
        }
    ]
}
```

**Ensure you create and substitute an External ID for `SUBSTITUTEME`.**

External ID Requirements

The External ID must be a 32+ character string that contains **only** alphanumeric characters, underscores, plus signs, equal signs, commas, periods, 'at' signs, colons, forward slashes, and hyphens. _External IDs that do not meet these requirements will be rejected._

5. Ensure the IAM Role ARN is populated in the Identity Policy you created in [Create an Identity Policy](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#create-an-identity-policy).

#### Connect to DataGrail

1. In DataGrail, navigate to **Integrations** and select **Configure New Integration** to search for **AWS SES**.
2. Under **Sender Email**, enter the email address you wish to use with your mailer.
3. Under **AWS Region**, enter the name of the AWS region used with the newly created Sender Identity.
4. Select **AWS Assume Role** under **Authentication Type**.
5. Under **Identity ARN**, enter the ARN of the Sender Identity.
6. Under **AssumeRole ARN**, enter the name of the IAM Role you just created.
7. Under **AssumeRole External ID**, enter the External ID of the IAM Role you just created.
8. Select **Configure Integration**.

### Connect With an Access Key

1. In DataGrail, navigate to **Integrations** and select **Configure New Integration** to search for **AWS SES**.
2. Under **Sender Email**, enter the email address you wish to use with your mailer.
3. Under **AWS Region**, enter the name of the AWS region used with the newly created Sender Identity.
4. Select **AWS Access Key** under **Authentication Type**.
5. Under **Identity ARN**, enter the ARN of the Sender Identity.
6. Select **Configure Integration**.

## Configure Sender Settings

After connecting the integration, configure the sender name and email address that will appear on all outgoing privacy communications to data subjects.

1. Select **Edit Integration**
2. Under **Sender Configurations**, select **Add Sender**.
3. Enter a **Sender Name** — this is the display name that will appear in the "From" field of emails sent to data subjects (e.g., `The Privacy Team`).
4. Enter a **From Address** — this must be a verified email address or domain within your AWS SES account (e.g., `privacy@company.com`).
5. Select **Send Test Email**, then **Send Email** to confirm your configuration has been successfully connected. You will receive a test email from the address entered.
6. Select **Save Sender**.

Multi-Brand Accounts

If your account has Multi-Brand enabled, you can add additional senders and associate them to specific groups. When a data subject request is submitted for a group, email communications will be sent from that group's configured sender. If no sender is assigned to a group, the default sender configured when the mailer was connected will be used.

## Next Steps

Now that you've successfully connected the integration, check out the following resources:

- [Transactional Mailer - Deliverability Testing](https://docs.datagrail.io/docs/request-manager/getting-started#mailer-configuration--deliverability-testing)
- [Direct Contact Integrations](https://docs.datagrail.io/docs/integrations/direct-contact/overview)

## Troubleshooting

If you are unable to successfully connect the integration, review these common troubleshooting steps:

- Ensure your SES account is not in sandbox mode

The DataGrail SES Integration requires a production AWS SES account. By default, AWS places all new accounts in sandbox mode.

_[Learn more about requesting production access](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html)_

- Ensure the External ID is valid

- Ensure all placeholder values in JSON policies are populated

All JSON policies in this documentation contain multiple placeholders for credentials you have created during the setup process. Please review the JSON policies for the IAM Users, Roles, or Resources.

- Ensure there are no other IAM Policies restricting AssumeRole

For AssumeRole configurations, please ensure any existing IAM Policies that restrict AssumeRole are updated to allow DataGrail to assume the [newly created IAM Role](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#create-the-iam-role).

- Ensure a configuration set is not applied to the identity

Configuration sets may interfere with DataGrail's ability to send mail through your Verified Identity. Ensure no configuration sets are applied to the Sender Identity associated with DataGrail.

- Ensure Required Permissions Are Granted on API Keys/Resources

DataGrail checks required permissions and scopes on API keys/resources used by each integration. If all necessary permissions are not granted, new connections will fail.

- Review Required Account Types and User Roles

If users do not have the necessary permissions or the minimum required user role in the connecting system, the connection to DataGrail will fail. Additionally, connections will fail if your account type does not match the one required by the integration.

See [Before You Start](https://docs.datagrail.io/docs/integrations/connection-instructions/ses/#before-you-start) to review these requirements.

Need help?

If you have any questions, please reach out to your dedicated Account Manager or contact us at [support@datagrail.io](mailto:support@datagrail.io).

_Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material._