# Create an AWS IAM user and access keys for Meisa

Source: https://help.meisa.io/articles/create-aws-iam-user-for-ses

Meisa sends through your own Amazon SES account using an access key. Create a dedicated IAM user (for example `meisa-sender`) with no console access, give it only the permissions below, and create one access key for it. This takes about 5 minutes.

Before you start, decide which AWS region you will use and stay in it. See [Which AWS SES region should I choose?](/articles/choose-an-aws-ses-region)

## Step 1: Create the permissions policy

1. Sign in to the AWS console and open **IAM** (type "IAM" in the search bar at the top).
2. In the left menu, click **Policies**, then **Create policy**.
3. Next to **Policy editor**, switch from **Visual** to **JSON**.
4. Delete everything in the editor and paste this policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MeisaSes",
      "Effect": "Allow",
      "Action": [
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:ListIdentities",
        "ses:VerifyDomainIdentity",
        "ses:VerifyDomainDkim",
        "ses:GetIdentityVerificationAttributes",
        "ses:GetIdentityDkimAttributes",
        "ses:DeleteIdentity",
        "ses:CreateConfigurationSet",
        "ses:CreateConfigurationSetEventDestination"
      ],
      "Resource": "*"
    },
    {
      "Sid": "MeisaTracking",
      "Effect": "Allow",
      "Action": ["sns:CreateTopic", "sns:Subscribe"],
      "Resource": "*"
    }
  ]
}
```

5. Click **Next**.
6. In **Policy name**, enter `MeisaSending`, then click **Create policy**.

## What each permission is for

| Permission | Why Meisa needs it |
|---|---|
| `ses:SendRawEmail` | Sends your emails, with unsubscribe headers and attachments. |
| `ses:GetSendQuota` | Checks your keys work when you save them, and reads your send rate so Meisa never sends faster than AWS allows. |
| `ses:VerifyDomainIdentity`, `ses:VerifyDomainDkim` | Adds your domain to SES and gets its DKIM records when you add a domain in Meisa. |
| `ses:GetIdentityVerificationAttributes`, `ses:GetIdentityDkimAttributes`, `ses:ListIdentities` | Checks whether your domain is verified, and finds domains you already verified in SES. |
| `ses:DeleteIdentity` | Removes the domain from SES when you delete it in Meisa. |
| `ses:CreateConfigurationSet`, `ses:CreateConfigurationSetEventDestination`, `sns:CreateTopic`, `sns:Subscribe` | Used once, when you click **Set up delivery tracking**, so bounces and complaints come back to Meisa. |

Meisa cannot read your mailboxes, billing, or anything else in your AWS account with this policy.

## Step 2: Create the IAM user

1. In IAM, click **Users** in the left menu, then **Create user**.
2. In **User name**, enter `meisa-sender`.
3. Leave **Provide user access to the AWS Management Console** unticked. This user only needs an access key. Click **Next**.
4. Under **Permissions options**, choose **Attach policies directly**.
5. In the search box, type `MeisaSending` and tick it. If it does not appear, click the refresh button next to **Create policy**.
6. Click **Next**, then **Create user**.

## Step 3: Create the access key

1. Click the new user `meisa-sender` in the users list.
2. Open the **Security credentials** tab.
3. In the **Access keys** section, click **Create access key**.
4. Under **Use case**, choose **Application running outside AWS**, then click **Next**.
5. The description tag is optional. Click **Create access key**.
6. On the **Retrieve access keys** page, copy the **Access key** (it starts with `AKIA`) and the **Secret access key** (click **Show**). You can also click **Download .csv file** and keep it somewhere safe.
7. Click **Done**.

The secret access key is shown only once. If you lose it, create a new access key and delete the old one.

Next, paste both keys into Meisa: [Connect Amazon SES to Meisa](/articles/connect-amazon-ses).

## Keep your keys safe

- Paste the keys only into Meisa's **Connect Amazon SES** form. Never send them by email or chat, including to Meisa support.
- Meisa stores your keys encrypted and only uses them to send your email.
- To rotate keys, create a second access key on the same user, update it in Meisa (**Email setup**, the **More actions** menu (three dots) on your provider, **Edit**), then deactivate and delete the old key in IAM.

## Troubleshooting

- **Meisa says "Amazon SES did not accept these details"**: the key was copied with a space, or the policy is not attached to the user. Check the user's **Permissions** tab lists `MeisaSending`.
- **Delivery tracking fails with AccessDenied**: the policy is missing one of the four tracking permissions. Edit the policy, add them, and try again.
- **A domain you deleted in Meisa comes back**: your policy is missing `ses:DeleteIdentity`, so it stayed in SES. Add the permission, or delete the identity in the SES console under **Identities**.
- **You used AmazonSESFullAccess instead**: it works, but it gives the key far more power than Meisa needs. We recommend the policy above.

## Related articles

- [Connect Amazon SES to Meisa](/articles/connect-amazon-ses)
- [Which AWS SES region should I choose?](/articles/choose-an-aws-ses-region)
- [Verify your sending domain (DKIM, SPF and DMARC)](/articles/verify-your-sending-domain)
- [How Meisa protects your data and AWS keys](/articles/how-meisa-protects-your-data)