Connect your own Amazon SES account

Connecting is one CloudFormation stack, and EmailFig does the rest. Open Settings → AWS, click Connect AWS Account, create the stack in your AWS console, and come back. The page moves itself from Waiting for your stack to Connected. You never type an AWS account number, and EmailFig never asks for an access key.

Before you start

• Sign in to the AWS account you want to send from, in the browser your console session is using. The button hands you straight to CloudFormation, so whichever account you’re signed into is the one that gets connected.
• You need permission to create an IAM role in that account.
• The stack is created in us-east-1; the link already selects it. BYOS works in this region only.

Connect

1. In EmailFig, open Settings → AWS. The card is titled Your AWS account.
2. Click Connect AWS Account. It opens the AWS CloudFormation console in a new tab, pre-filled with EmailFig’s template, the stack name emailfig-connect, and two parameters.
3. Leave the parameters alone. Editing either produces a role EmailFig can’t use.
4. Tick the acknowledgement that the stack creates IAM resources, then click Create stack.
5. Go back to the EmailFig tab. Nothing to refresh: the card’s status moves on its own, from Waiting for your stack to Setting up and then to Connected — SES sandbox or Connected.

Setting up usually takes about a minute. While it runs, the card says Setting up your AWS account. This usually takes a minute. When it finishes we email you, subject Your AWS account is connected.

What happens behind that one click

The stack creates a single IAM role called EmailfigConnectRole and nothing else. EmailFig then uses that role to build the SES resources your sending needs inside your account: an SNS topic, an SES tenant, a configuration set and an event destination. What the CloudFormation stack creates lists every permission the role carries.

Then what

1. Add and verify a sending domain. Until your AWS connection is working, the sending domains page offers Set up AWS first instead of Add domain. Being in the SES sandbox doesn’t block this, and AWS asks for a verified domain when you request production access. See Add and verify a sending domain.
2. Request production access so SES will deliver to people who haven’t verified themselves. See Leave the SES sandbox.

When it doesn’t connect

The card names the problem and offers the one button that helps:

• “That AWS account is already connected to another EmailFig account.” An AWS account can back exactly one EmailFig account. The launch button stays so you can connect a different one. If the other account is yours, email support@emailfig.com from the address you sign in with.
• “Your stack reached us but we couldn’t finish connecting it. Nothing is wrong with your AWS setup.” A fault on our side, with no button. Email support@emailfig.com with your sign-in email.
• “We reached your AWS account but couldn’t finish setting SES up in it.” Check the stack finished in CloudFormation, then click Try again. The pass re-runs safely; nothing is created twice.
• “We can’t assume the EmailfigConnectRole in your AWS account.” The stack was deleted, rolled back, or its trust policy edited. Check the stack still exists in us-east-1 with the role in it.

Every other health message is covered in AWS connection health errors.

If the stack never reports back

CloudFormation waits for EmailFig to answer before it finishes. If it can’t reach us, it gives up after an hour and rolls the stack back, deleting the role. Launch it again from Settings → AWS; the retry is free.

If the stack completed in AWS but EmailFig still says Waiting for your stack an hour later, email support@emailfig.com with your sign-in email and the stack’s ID.

Next

• What the CloudFormation stack creates
• Leave the SES sandbox: request production access
• Add and verify a sending domain