Meisa Help

Create an AWS IAM user and access keys for Meisa

Create an IAM user with no console access, attach a small SES and SNS policy, then create an access key to paste into Meisa.

Updated 3 min read
On this page

Meisa sends through your own Amazon SES account using an access key. Create a dedicated IAM user (for example meisa-sender) with no console access, give it only the permissions below, and create one access key for it. This takes about 5 minutes.

Before you start, decide which AWS region you will use and stay in it. See Which AWS SES region should I choose?

Step 1: Create the permissions policy

  1. Sign in to the AWS console and open IAM (type “IAM” in the search bar at the top).
  2. In the left menu, click Policies, then Create policy.
  3. Next to Policy editor, switch from Visual to JSON.
  4. Delete everything in the editor and paste this policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MeisaSes",
      "Effect": "Allow",
      "Action": [
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:ListIdentities",
        "ses:VerifyDomainIdentity",
        "ses:VerifyDomainDkim",
        "ses:GetIdentityVerificationAttributes",
        "ses:GetIdentityDkimAttributes",
        "ses:DeleteIdentity",
        "ses:CreateConfigurationSet",
        "ses:CreateConfigurationSetEventDestination"
      ],
      "Resource": "*"
    },
    {
      "Sid": "MeisaTracking",
      "Effect": "Allow",
      "Action": ["sns:CreateTopic", "sns:Subscribe"],
      "Resource": "*"
    }
  ]
}
  1. Click Next.
  2. In Policy name, enter MeisaSending, then click Create policy.

What each permission is for

Permission Why Meisa needs it
ses:SendRawEmail Sends your emails, with unsubscribe headers and attachments.
ses:GetSendQuota Checks your keys work when you save them, and reads your send rate so Meisa never sends faster than AWS allows.
ses:VerifyDomainIdentity, ses:VerifyDomainDkim Adds your domain to SES and gets its DKIM records when you add a domain in Meisa.
ses:GetIdentityVerificationAttributes, ses:GetIdentityDkimAttributes, ses:ListIdentities Checks whether your domain is verified, and finds domains you already verified in SES.
ses:DeleteIdentity Removes the domain from SES when you delete it in Meisa.
ses:CreateConfigurationSet, ses:CreateConfigurationSetEventDestination, sns:CreateTopic, sns:Subscribe Used once, when you click Set up delivery tracking, so bounces and complaints come back to Meisa.

Meisa cannot read your mailboxes, billing, or anything else in your AWS account with this policy.

Step 2: Create the IAM user

  1. In IAM, click Users in the left menu, then Create user.
  2. In User name, enter meisa-sender.
  3. Leave Provide user access to the AWS Management Console unticked. This user only needs an access key. Click Next.
  4. Under Permissions options, choose Attach policies directly.
  5. In the search box, type MeisaSending and tick it. If it does not appear, click the refresh button next to Create policy.
  6. Click Next, then Create user.

Step 3: Create the access key

  1. Click the new user meisa-sender in the users list.
  2. Open the Security credentials tab.
  3. In the Access keys section, click Create access key.
  4. Under Use case, choose Application running outside AWS, then click Next.
  5. The description tag is optional. Click Create access key.
  6. On the Retrieve access keys page, copy the Access key (it starts with AKIA) and the Secret access key (click Show). You can also click Download .csv file and keep it somewhere safe.
  7. Click Done.

The secret access key is shown only once. If you lose it, create a new access key and delete the old one.

Next, paste both keys into Meisa: Connect Amazon SES to Meisa.

Keep your keys safe

  • Paste the keys only into Meisa’s Connect Amazon SES form. Never send them by email or chat, including to Meisa support.
  • Meisa stores your keys encrypted and only uses them to send your email.
  • To rotate keys, create a second access key on the same user, update it in Meisa (Email setup, the More actions menu (three dots) on your provider, Edit), then deactivate and delete the old key in IAM.

Troubleshooting

  • Meisa says “Amazon SES did not accept these details”: the key was copied with a space, or the policy is not attached to the user. Check the user’s Permissions tab lists MeisaSending.
  • Delivery tracking fails with AccessDenied: the policy is missing one of the four tracking permissions. Edit the policy, add them, and try again.
  • A domain you deleted in Meisa comes back: your policy is missing ses:DeleteIdentity, so it stayed in SES. Add the permission, or delete the identity in the SES console under Identities.
  • You used AmazonSESFullAccess instead: it works, but it gives the key far more power than Meisa needs. We recommend the policy above.

Did this answer your question?

Keep reading

Still need help?

Chat with us and get an answer in a few minutes.