Amazon SES notifications
Before you start
- Verify your sender email address/domain in the selected SES region.
- Create restricted credentials with ses:SendEmail permission for the sender identity. Region and credentials must refer to the same AWS partition/account setup.
- Provide the region, access key ID, secret access key, sender and one recipient address. Include a session token only for temporary credentials, and update all temporary credentials before expiry.
- SES sandbox restrictions are regional. In the sandbox, recipients must also be verified; request production access when needed.
Configuration
| Field | Required | Default |
|---|---|---|
| Access key ID | Yes | — |
| Secret access key | Yes | — |
| Session token | No | — |
| AWS region | Yes | us-east-1 |
| From email | Yes | — |
| To email | Yes | — |
Test and enable
- In CertOne, add a notification target and choose this channel.
- Fill in the configuration and send a test message.
- Check that the message arrived at the intended destination, then save the target.
- Select the saved target in the settings for the notification events you need.
A successful API response means the service accepted the request. It does not prove that the final client or mailbox received it. If a request times out, delivery may already have occurred; check the destination before retrying.
Email targets send UTF-8 plain text and escaped HTML. Sender verification, account approval, quotas, suppression lists and mailbox filtering are controlled by your email provider. Only one sender and one recipient address per target are supported.
Troubleshooting
- Use credentials with ses:SendEmail permission in this region and a verified sender identity. Sandbox accounts also require verified recipients. Temporary credentials must be updated before expiration. API acceptance does not guarantee inbox delivery.
- Check token permissions, account quota, destination ID and server reachability.
- Sensitive credentials are not included in returned error messages.