Email: AWS SES

Create least-privilege AWS SES credentials so your OptixLog deployment can send transactional mail through your own AWS account.

OptixLog sends transactional mail (invitations, notifications) through an email provider that you own. Credentials are pasted once, verified with a real connection test, and stored encrypted inside your deployment. Mail flows directly from your OptixLog instance to AWS SES; no OptixLog-operated service is involved.

What you'll need

An AWS account with Amazon SES available in your preferred region.
Permission to create IAM users and SES identities.

Verify a sender identity

In the AWS console open Amazon SES → Identities → Create identity. Verify either a whole domain (recommended) or the single email address you plan to send from, for example notifications@example.com. Complete the DNS or mailbox verification until the identity shows Verified.

Leave the sandbox (production accounts)

New SES accounts start in the sandbox and can only send to verified addresses. For real invitation mail request production access under Amazon SES → Account dashboard → Request production access.

Create a least-privilege IAM user

Create an IAM user (no console access) with an inline policy that only allows sending and the read calls OptixLog uses to verify the connection:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetAccount",
        "ses:GetEmailIdentity"
      ],
      "Resource": "*"
    }
  ]
}

Then create an access key for the user (Security credentials → Create access key, use case "Application running outside AWS") and copy the access key ID and secret access key.

Connect it in OptixLog

In OptixLog open Management → Integrations → Email delivery (or the Integrations step during first-install onboarding) and pick AWS SES. Fill in:

Field	Value
AWS region	The region where the identity lives, e.g. `us-east-1`
Access key ID	The IAM access key ID (`AKIA...`)
Secret access key	The IAM secret access key
Sender email	The verified identity, e.g. `notifications@example.com`

Click Verify. OptixLog authenticates against SES (GetAccount) and checks that the sender address or its domain is a verified identity that may send. Save to store the credentials encrypted.

Troubleshooting

Error	Fix
The credentials are rejected	Re-copy the access key ID and secret; confirm the IAM policy above is attached.
Identity is not verified	Finish DNS/mailbox verification for the sender address or its domain in the selected region.
Sending is disabled	The account is paused or still sandboxed in that region; check the SES account dashboard.