Email permissions

Identity management, sending, diagnostics, and received-message access have separate IAM actions. The table includes the additional topic permission required when saving an incoming-mail rule.

Actions

The endpoint reference describes request fields and responses. This table maps each call to its IAM action.

Call	Required action
`GET /v1/identities/{identity_id}/receiving`	`email:GetReceivingConfiguration`
`PATCH /v1/identities/{identity_id}/receiving`	`email:UpdateReceivingConfiguration`
`GET /v1/received-messages`	`email:ListReceivedMessages`
`GET /v1/received-messages/{message_id}`	`email:DescribeReceivedMessage`
`GET /v1/received-messages/{message_id}/content`	`email:GetReceivedMessageContent`
`GET /v1/identities`	`email:ListIdentities`
`POST /v1/identities`	`email:CreateIdentity`
`GET /v1/identities/{identity_id}`	`email:DescribeIdentity`
`DELETE /v1/identities/{identity_id}`	`email:DeleteIdentity`
`PATCH /v1/identities/{identity_id}`	`email:UpdateIdentity`
`POST /v1/identities/{identity_id}/verify`	`email:VerifyIdentity`
`POST /v1/identities/{identity_id}/dkim/rotate`	`email:RotateDKIM`
`DELETE /v1/identities/{identity_id}/dkim/rotate`	`email:RotateDKIM`
`POST /v1/identities/{identity_id}/dkim/rotate/finalize`	`email:RotateDKIM`
`PATCH /v1/identities/{identity_id}/mail-from-domain`	`email:SetMailFromDomain`
`POST /v1/identities/{identity_id}/mail-from-domain/verify`	`email:VerifyMailFromDomain`
`PATCH /v1/identities/{identity_id}/bimi`	`email:SetBIMI`
`POST /v1/identities/{identity_id}/bimi/verify`	`email:VerifyBIMI`
`GET /v1/sent-messages`	`email:ListMessages`
`POST /v1/sent-messages`	`email:SendMessage`
`GET /v1/sent-messages/{message_id}`	`email:DescribeMessage`
`GET /v1/sent-messages/{message_id}/engagement`	`email:GetMessageEngagement`
`GET /v1/rejections`	`email:ListRejections`
`GET /v1/suppressions`	`email:ListSuppressions`
`POST /v1/suppressions`	`email:CreateSuppression`
`GET /v1/templates`	`email:ListTemplates`
`POST /v1/templates`	`email:CreateTemplate`
`GET /v1/templates/{template_id}`	`email:DescribeTemplate`
`PATCH /v1/templates/{template_id}`	`email:UpdateTemplate`
`DELETE /v1/templates/{template_id}`	`email:DeleteTemplate`
`GET /v1/configuration-sets`	`email:ListConfigurationSets`
`POST /v1/configuration-sets`	`email:CreateConfigurationSet`
`GET /v1/configuration-sets/{configuration_set_id}`	`email:DescribeConfigurationSet`
`PATCH /v1/configuration-sets/{configuration_set_id}`	`email:UpdateConfigurationSet`
`DELETE /v1/configuration-sets/{configuration_set_id}`	`email:DeleteConfigurationSet`
`POST /v1/configuration-sets/{configuration_set_id}/suppression-overrides`	`email:UpdateConfigurationSet`
`DELETE /v1/configuration-sets/{configuration_set_id}/suppression-overrides/{address}`	`email:UpdateConfigurationSet`
`GET /v1/ip-pools`	`email:ListIPPools`
`POST /v1/ip-pools`	`email:CreateIPPool`
`GET /v1/ip-pools/{ip_pool_id}`	`email:DescribeIPPool`
`PATCH /v1/ip-pools/{ip_pool_id}`	`email:UpdateIPPool`
`DELETE /v1/ip-pools/{ip_pool_id}`	`email:DeleteIPPool`
`GET /v1/dedicated-ips`	`email:ListDedicatedIPs`
`POST /v1/dedicated-ips`	`email:RequestDedicatedIP`
`GET /v1/dedicated-ips/{dedicated_ip_id}`	`email:DescribeDedicatedIP`
`PATCH /v1/dedicated-ips/{dedicated_ip_id}`	`email:UpdateDedicatedIP`
`DELETE /v1/dedicated-ips/{dedicated_ip_id}`	`email:ReleaseDedicatedIP`
`GET /v1/identities/{identity_id}/recipient-rules`	`email:ListRecipientRules`
`POST /v1/identities/{identity_id}/recipient-rules`	`notifications:Publish`
`GET /v1/identities/{identity_id}/recipient-rules/{rule_id}`	`email:DescribeRecipientRule`
`PATCH /v1/identities/{identity_id}/recipient-rules/{rule_id}`	`email:UpdateRecipientRule`
`DELETE /v1/identities/{identity_id}/recipient-rules/{rule_id}`	`email:DeleteRecipientRule`
`GET /v1/sent-messages/{message_id}/content`	`email:GetSentMessageContent`
`GET /v1/sent-messages/{message_id}/raw`	`email:GetSentMessageContent`
`GET /v1/sent-messages/{message_id}/attachments/{attachment_id}`	`email:GetSentMessageContent`
`GET /v1/received-messages/{message_id}/raw`	`email:GetReceivedMessageContent`
`GET /v1/received-messages/{message_id}/attachments/{attachment_id}`	`email:GetReceivedMessageContent`
`POST /v1/sent-messages/batch`	`email:SendMessage`
`GET /v1/suppressions/{suppression_id}`	`email:DescribeSuppression`
`PATCH /v1/suppressions/{suppression_id}`	`email:UpdateSuppression`
`DELETE /v1/suppressions/{suppression_id}`	`email:DeleteSuppression`
`GET /v1/identities/{identity_id}/dmarc-reports`	`email:ListDMARCReports`

Receiving rules require two grants

Saving a recipient rule requires email:CreateRecipientRule on the identity and notifications:Publish on the destination topic. The topic must belong to the same account. An explicit deny in its resource policy also blocks the rule.

Metadata and content are separate

email:DescribeReceivedMessage reads received-message metadata. email:GetReceivedMessageContent reads content and downloads attachments. Grant the content action only to callers that need access to the mail itself. Open and click tracking URLs are used by recipient mail clients and browsers. They are not management operations.

Telemetry

Email charts use telemetry:ReadMetrics. This grant is separate from email:DescribeIdentity and the diagnostic Email actions. See Email metrics for metric names and scope.

Example policy

This policy grants only the listed collection reads. It does not grant permission to send messages or manage resources.

{
  "version": "2024-01-01",
  "statements": [
    {
      "effect": "allow",
      "actions": [
        "email:ListIdentities",
        "email:ListTemplates"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

See IAM policies for policy evaluation and Email for the service overview.

Attachment buckets

Selecting a receiving bucket requires storage:PutObject and storage:GetObject on its email/{identity_id}/* objects. This creates a bounded delegation for email processing; current identity policies, permission boundaries, bucket policies, and any session scope-down still apply. Bucket access failures defer incoming delivery. Sending an existing object requires storage:GetObject on that object. Sending raw MIME attachments to attachments_bucket requires both operations under email/{identity_id}/sent/*. Customer buckets must be in the same account and region. Message content permissions do not grant general access to unrelated bucket objects. Template content requires email:SendMessage on the identity and email:SendTemplatedMessage on the template for both single and batch sends. Explicit denies apply to both resources. Updating a recipient rule requires email:UpdateRecipientRule and publication permission on its destination topic.

Get started

Products

Platform

Help

Email permissions

Actions

Receiving rules require two grants

Metadata and content are separate

Telemetry

Example policy

Attachment buckets

​Actions

​Receiving rules require two grants

​Metadata and content are separate

​Telemetry

​Example policy

​Attachment buckets

Actions

Receiving rules require two grants

Metadata and content are separate

Telemetry

Example policy

Attachment buckets