> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking Amazon SES as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/aws-ses

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links).

## On this page

- [Prerequisites](#prerequisites)
- [Adding a data source](#adding-a-data-source)
- [Creating IAM credentials](#creating-iam-credentials)
- [Sync modes](#sync-modes)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)
- [Troubleshooting](#troubleshooting)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

The Amazon SES connector syncs your SES account data into PostHog, so you can monitor sending health, quota, verified identities, and suppressed recipients alongside your product data.

This source syncs account-level data from the SES API. Per-message send, bounce, and complaint events are only available through [SES event destinations](https://docs.aws.amazon.com/ses/latest/dg/monitor-using-event-publishing.html), not the SES API, so they are not included.

## Prerequisites

You need an AWS account that sends email through Amazon SES.

You also need an IAM user or role with the following permissions:

-   `ses:GetAccount`
-   `ses:ListConfigurationSets`
-   `ses:GetConfigurationSet`
-   `ses:ListEmailIdentities`
-   `ses:GetEmailIdentity`
-   `ses:ListSuppressedDestinations`
-   `ses:ListEmailTemplates`
-   `ses:GetEmailTemplate`
-   `ses:ListContactLists`
-   `ses:GetContactList`
-   `ses:ListDedicatedIpPools`
-   `ses:GetDedicatedIpPool`
-   `ses:GetDedicatedIps`
-   `ses:ListCustomVerificationEmailTemplates`
-   `ses:GetCustomVerificationEmailTemplate`
-   `ses:ListMultiRegionEndpoints`

SES data is regional. Connect one source per AWS region you send email from.

## Adding a data source

1.  In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section.
2.  Click **\+ New source** and click **Link** next to this source.
3.  Enter your credentials (see [Configuration](#configuration) below) and click **Next**.
4.  Select the tables you want to sync, choose a sync method and frequency, then click **Import**.

Once the syncs are complete, you can start querying this data in PostHog.

When linking Amazon SES, you'll need:

-   **AWS access key ID**: the access key ID for your IAM user or role (starts with `AKIA...`).
-   **AWS secret access key**: the corresponding secret access key.
-   **AWS region**: the region your SES account sends from, like `us-east-1`.
-   **AWS session token** (optional): only required if you are using temporary STS credentials.

## Creating IAM credentials

1.  In the AWS Console, go to **IAM** > **Users** and create a new user (or use an existing one).
2.  Attach a policy with the following permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:GetAccount",
        "ses:ListConfigurationSets",
        "ses:GetConfigurationSet",
        "ses:ListEmailIdentities",
        "ses:GetEmailIdentity",
        "ses:ListSuppressedDestinations",
        "ses:ListEmailTemplates",
        "ses:GetEmailTemplate",
        "ses:ListContactLists",
        "ses:GetContactList",
        "ses:ListDedicatedIpPools",
        "ses:GetDedicatedIpPool",
        "ses:GetDedicatedIps",
        "ses:ListCustomVerificationEmailTemplates",
        "ses:GetCustomVerificationEmailTemplate",
        "ses:ListMultiRegionEndpoints"
      ],
      "Resource": "*"
    }
  ]
}
```

3.  Create an access key for the user under **Security credentials** > **Access keys**.
4.  Copy the **Access key ID** and **Secret access key**. You'll need both when linking the source in PostHog.

If you grant only some of these permissions, the tables you can't read are flagged in the table picker so you can deselect them.

## Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

-   **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
-   **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured.
-   **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
-   **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See [sync methods](https://posthog.com/docs/data-pipelines/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them.

The `suppressed_destinations` table supports incremental sync using `last_update_time` as the cursor, so each sync only fetches addresses added or updated since the last one. Addresses removed from the suppression list in AWS are not deleted from the synced table.

The other tables are small and sync as a full refresh. The `account` table is a snapshot: it holds one row describing the account at the time of the latest sync.

## Configuration

| Option | Description |
| --- | --- |
| `AWS access key ID` **Type:** text **Required:** True |  |
| `AWS secret access key` **Type:** password **Required:** True |  |
| `AWS region` **Type:** text **Required:** True |  |
| `AWS session token` **Type:** password **Required:** False | Only for temporary credentials. Session tokens expire after a few hours, so scheduled syncs will fail once the token expires. Use a permanent access key (starts with AKIA) for recurring imports. |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| `account` | Sending status, quota, and reputation enforcement for the connected AWS Region. One row per sync. | Full refresh | — | — |
| `configuration_sets` | Configuration sets with their tracking, delivery, reputation, sending, and suppression options. | Full refresh | — | — |
| `contact_lists` | Contact lists that store your contacts, with their topics, description, and timestamps. | Full refresh | — | — |
| `custom_verification_email_templates` | Custom verification email templates, with their sender, subject, content, and redirect URLs. | Full refresh | — | — |
| `dedicated_ip_pools` | Dedicated IP pools in the account, with the scaling mode of each pool. | Full refresh | — | — |
| `dedicated_ips` | Dedicated IP addresses assigned to the account, with their warm-up progress and pool assignment. | Full refresh | — | — |
| `email_identities` | Verified email identities (domains and addresses) with DKIM, MAIL FROM, and verification details. | Full refresh | — | — |
| `email_templates` | Email templates stored in SES, with their subject line and HTML and plain-text bodies. | Full refresh | — | — |
| `multi_region_endpoints` | Multi-region endpoints (global endpoints), with their status and the AWS Regions they route sending to. | Full refresh | — | — |
| `suppressed_destinations` | Email addresses on the account-level suppression list, with the reason and time they were added. | Incremental, Full refresh | last\_update\_time | — |

## Troubleshooting

-   If you see "AWS rejected the access key", check that the access key ID and secret access key are correct and that the key is still active in IAM.
-   If you see a signature error, re-enter the secret access key. If you are using temporary credentials, the session token may have expired.
-   If you see "missing SES read permissions", grant the `ses:` permissions listed above to the IAM user or role.
-   If a sync fails with a region error, check that the region is a valid AWS region code like `us-east-1` and that your SES account sends from that region.

If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](https://posthog.com/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.