SFLWA Identity & Tenant Provisioner for Amazon SES

Description

SES Tenant Provisioner by SFLWA provides agency-grade, automated multi-tenant onboarding and monitoring for Amazon SES using native SES API v2.

Effortlessly provision isolated client tenants, create sending identities, assign default configuration sets, auto-generate dedicated IAM credentials, and monitor client tenant health directly from your WordPress admin dashboard.

Key Features:

• Automated Tenant Onboarding: Creates SES API v2 tenants, creates domain identities, and binds them to specified tenant resources automatically.
• Automated IAM Provisioning: Creates dedicated IAM sending users, adds them to your designated sending group, and issues access keys upon setup.
• Instant DKIM CNAME Records: Generates short host, fully qualified domain names (FQDN), and CNAME target values with one-click copy buttons.
• X-SES-TENANT Header Snippet: Produces ready-to-use WordPress code snippets (wp_mail hook) for client site integration.
• Native Tenant Statistics Dashboard: Displays current sending status, assigned domain identities, bound configuration sets, and reputation impact warnings across all saved parent accounts.
• Multi-Account Support: Easily switch between different parent AWS operator accounts.
• Zero Additional API Costs: Designed strictly around native Amazon SES API v2 calls (ListTenants, GetTenant, ListTenantResources) to keep overhead completely free.

IAM Operator Policy

Your parent AWS Operator user requires an IAM policy permitting SES API v2 tenant management, IAM user provisioning, and STS caller identity verification.

Attach the following policy to your operator user in AWS IAM:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SESManagementAndReportingPermissions",
            "Effect": "Allow",
            "Action": [
                "ses:CreateEmailIdentity",
                "ses:GetEmailIdentity",
                "ses:CreateTenant",
                "ses:CreateTenantResourceAssociation",
                "ses:ListTenants",
                "ses:GetTenant",
                "ses:ListTenantResources"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IAMUserAndGroupProvisioning",
            "Effect": "Allow",
            "Action": [
                "iam:CreateUser",
                "iam:AddUserToGroup",
                "iam:CreateAccessKey",
                "iam:AttachUserPolicy"
            ],
            "Resource": "*"
        },
        {
            "Sid": "STSCallerIdentity",
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity"
            ],
            "Resource": "*"
        }
    ]
}

External Services

This plugin integrates directly with Amazon Web Services (AWS) via official API calls to provision and monitor Amazon Simple Email Service (SES) resources.

• Service Name: Amazon Simple Email Service (SES) API v2
• Primary Usage: Submits domain and email verification requests, fetches DKIM/DNS records, manages tenant identities, and retrieves account health statistics.
• AWS Terms of Service: https://aws.amazon.com/service-terms/
• AWS Customer Agreement: https://aws.amazon.com/agreement/
• AWS Privacy Notice: https://aws.amazon.com/privacy/

Thank You

Thank you to WebCami for your support of my work.