I tried to organize whether a VPC endpoint aggregation configuration can be maintained with Amazon SES Mail Manager SMTP
This page has been translated by machine translation. View original
Introduction
In July 2026, Amazon Simple Email Service (Amazon SES) added a guided setup for SMTP sending environments using Mail Manager.
The guided setup automatically creates and configures the following resources and credentials required for SMTP sending.
- Authenticated ingress endpoint
- Traffic policy
- Rule set
- IAM role
- SMTP credentials
The following article walks through building a Mail Manager SMTP environment using the guided setup and verifying email sending from an SMTP client.
With traditional SES SMTP, SMTP credentials generated from an IAM user's access key are used.
With Mail Manager SMTP, on the other hand, Mail Manager SMTP credentials are used to connect to the authenticated ingress endpoint, and an IAM role configured in the rule set is used to send emails.
AWS documentation also recommends using Mail Manager in regions where both the traditional IAM user credentials flow and Mail Manager are available. The traditional IAM user credentials flow remains available as well.
What caught my attention here is the case where SES SMTP VPC endpoints are aggregated in a multi-account environment.
The following article introduces a configuration where SES SMTP VPC endpoints are placed in a single AWS account and used by multiple AWS accounts.
This article examines whether it is possible to migrate from traditional SES SMTP to Mail Manager SMTP while maintaining this aggregated configuration, based on publicly available documentation as of August 2026.
In this article, each AWS account is referred to as follows.
| Name | Role |
|---|---|
| Aggregation account | The AWS account that hosts the SES SMTP VPC endpoints and Amazon Route 53 private hosted zones |
| Workload account | The AWS account that hosts the mail-sending applications and Amazon SES |
Conclusion
With the standard configuration described in the public documentation, it is not possible to migrate to Mail Manager SMTP while maintaining both of the following. Note that this article does not cover cross-account sending configurations using SES sending authorization.
- Placing SMTP VPC endpoints in the aggregation account
- Isolating SES sending quotas and reputation metrics per workload account
When migrating to Mail Manager SMTP, one of the following configuration changes is required.
| Post-migration approach | Required configuration change |
|---|---|
| Isolate SES sending quotas and reputation metrics per workload account | Place Mail Manager VPC endpoints and authenticated ingress endpoints in each workload account |
| Maintain VPC endpoint aggregation | Place the Mail Manager and Amazon SES sending infrastructure in the aggregation account |
If you want to maintain the current configuration of "VPC endpoints in the aggregation account, with SES sending quotas and reputation metrics isolated per workload account," you will need to continue using traditional SES SMTP.
Current VPC Endpoint Aggregation Configuration
In the assumed configuration, the following resources are placed in the aggregation account.
- SES SMTP VPC endpoint
- Security group for VPC endpoint
- Amazon Route 53 private hosted zone
Each workload account hosts the following resources.
- Mail-sending application
- SES verified identity
- SMTP credentials derived from an IAM user
The flow when sending email from workload account A is as follows.
Workload Account A
Mail-sending application
↓ Uses SMTP credentials A
SES SMTP VPC endpoint in aggregation account
↓
Amazon SES SMTP interface
↓ Sends with the permissions of the IAM user corresponding to SMTP credentials A
Amazon SES in workload account A
↓
Sent to the internet
When sending email from workload account B, the same VPC endpoint is used.
Workload Account B
Mail-sending application
↓ Uses SMTP credentials B
SES SMTP VPC endpoint in aggregation account
↓
Amazon SES SMTP interface
↓ Sends with the permissions of the IAM user corresponding to SMTP credentials B
Amazon SES in workload account B
↓
Sent to the internet
The VPC endpoint in the aggregation account is used as the network path for SMTP connections.
The IAM users and SMTP credentials used for email sending, however, differ per workload account.
Traditional SES SMTP credentials are generated based on the access key of an IAM user created in the workload account.
When an SMTP client uses these credentials, email is sent with the permissions of the corresponding IAM user. Therefore, even when going through the aggregation account's VPC endpoint, the Amazon SES used for sending email is on the workload account side where the SMTP credentials were created.
IAM user in workload account A
↓ Generated from access key
SMTP credentials A
↓ Used by SMTP client for authentication
Email sent with workload account A's permissions
This configuration allows aggregating the SES SMTP VPC endpoints while keeping the Amazon SES used for email sending separate per workload account.
SES sending quotas are set per AWS account and AWS region. Reputation metrics such as bounce rate and complaint rate are also managed per AWS account that sends email.
Mail Manager SMTP Processing
When using Mail Manager SMTP with a private connection, email sent from an SMTP client is processed as follows.
SMTP client
↓ STARTTLS・SMTP AUTH
Mail Manager VPC endpoint
↓
Authenticated ingress endpoint
↓
Allowed or denied by traffic policy
↓ Allowed email
Rule set
↓
"Send to internet" action
↓ Executes SendRawEmail API with the permissions of the specified IAM role
Amazon SES
↓
Sent to the internet
The authenticated ingress endpoint accepts email from SMTP clients with authentication.
The information used for SMTP authentication is as follows.
| Item | Value |
|---|---|
| Username | Ingress endpoint ID |
| Password | The password configured on the ingress endpoint, or an AWS Secrets Manager secret |
For private connections, the SMTP client connects to the DNS name provided by the Mail Manager VPC endpoint.
The authenticated ingress endpoint supports ports 25 and 587, and STARTTLS. SMTP AUTH methods are AUTH LOGIN and AUTH PLAIN.
The traffic policy allows or denies email based on conditions such as source IP address, TLS, sender, and recipient.
Allowed email has the rule set associated with the ingress endpoint applied to it. When a rule's conditions are met, the actions configured in the rule are executed.
The "Send to internet" action used here sends email using the Amazon SES SendRawEmail API with the permissions of the specified IAM role.
The RoleArn in SendAction is a required field. The specified IAM role must have permission to execute ses:SendRawEmail.
The roles of the SMTP credentials and IAM role are summarized as follows.
| Item | Role |
|---|---|
| SMTP credentials | Authenticates the connection to the authenticated ingress endpoint |
| IAM role | Provides permissions for the "Send to internet" action to call Amazon SES |
With traditional SES SMTP, email is sent with the permissions of the IAM user corresponding to the SMTP credentials.
Traditional SES SMTP
SMTP credentials
↓
Authenticates connection to SES SMTP interface
↓
Email sent with the permissions of the corresponding IAM user
With Mail Manager SMTP, on the other hand, SMTP credentials are used to authenticate the connection to the ingress endpoint. The IAM role configured in the rule set is used to send email.
Mail Manager SMTP
SMTP credentials
↓
Authenticates connection to authenticated ingress endpoint
↓
Email sent with the permissions of the IAM role configured in the rule set
This difference is the reason why the current VPC endpoint aggregation configuration cannot be migrated as-is.
Constraints Related to VPC Endpoint Aggregation
VPC endpoints and ingress endpoints must be owned by the same account
When using a Mail Manager private ingress endpoint, the Mail Manager VPC endpoint and the ingress endpoint must be owned by the same AWS account.
Cross-account association is not supported.
The possible combinations for placement are as follows.
| Mail Manager VPC endpoint | Ingress endpoint | Association |
|---|---|---|
| Aggregation account | Aggregation account | Possible |
| Workload account | Workload account | Possible |
| Aggregation account | Workload account | Not possible |
| Workload account | Aggregation account | Not possible |
Therefore, if the Mail Manager VPC endpoint is placed in the aggregation account, the authenticated ingress endpoint must also be placed in the aggregation account.
However, this does not mean that SMTP clients must also be placed in the aggregation account.
With appropriate configuration of network reachability, security groups, routing, and name resolution, it should be possible to connect from applications in a workload account to the VPC endpoint in the aggregation account.
VPC endpoints and ingress endpoints are associated one-to-one
One Mail Manager VPC endpoint can be associated with only one ingress endpoint.
Mail Manager VPC endpoint A
↓
Ingress endpoint A
Creating a different ingress endpoint requires a separate VPC endpoint.
Mail Manager VPC endpoint B
↓
Ingress endpoint B
This constraint does not mean that a single ingress endpoint cannot be used by multiple SMTP clients.
A configuration where multiple workload accounts connect to the same VPC endpoint and ingress endpoint placed in the aggregation account is conceivable.
However, the rule set and IAM role used after connection are those configured in the Mail Manager on the aggregation account side.
The IAM role for sending must be placed in the same account as Mail Manager
In the Mail Manager "Send to internet" action, you specify an IAM role that can execute Amazon SES's SendRawEmail API.
This IAM role requires a trust policy allowing Amazon SES to assume the role, and a permission policy for sending email.
iam:PassRole, which passes an IAM role to an AWS service, is used for IAM roles in the same AWS account as the AWS service receiving the role.
You cannot directly pass an IAM role from account A to an AWS service in account B.
Therefore, when placing Mail Manager in the aggregation account, the IAM role configured in the rule set is also placed in the aggregation account.
Aggregation account
Mail Manager rule set
↓
"Send to internet" action
↓ Executes SendRawEmail API with the permissions of the aggregation account's IAM role
Amazon SES
↓
Sent to the internet
Regardless of which workload account the SMTP client connects from, the IAM role configured in the rule set is used for email sending.
Proposed Post-Migration Configurations
When maintaining VPC endpoints in the aggregation account
If you want to maintain VPC endpoint aggregation, place Mail Manager-related resources in the aggregation account as well.
The configuration and email sending flow are as follows.
Each workload account
Mail-sending application
↓ STARTTLS・SMTP AUTH
Mail Manager VPC endpoint in aggregation account
↓
Authenticated ingress endpoint in aggregation account
↓
Allowed or denied by traffic policy
↓ Allowed email
Rule set
↓
"Send to internet" action
↓ Executes SendRawEmail API with the permissions of the aggregation account's IAM role
Amazon SES in aggregation account
↓
Sent to the internet
In this configuration, the Mail Manager VPC endpoint and authenticated ingress endpoint placed in the aggregation account are used by multiple workload accounts.
However, SMTP credentials are used to authenticate connections to the authenticated ingress endpoint. Unlike traditional SES SMTP credentials, they do not switch which AWS account is used for email sending.
The IAM role configured in the aggregation account's rule set is used for email sending. Therefore, in the standard configuration covered in this article, Amazon SES is also used on the aggregation account side.
The following settings and metrics are also managed on the aggregation account side.
- SES verified identities
- Sandbox removal status
- Sending quotas
- Bounce rate
- Complaint rate
Email sent from each workload account is all reflected in the aggregation account's sending quotas and reputation metrics.
For example, if the bounce rate or complaint rate rises due to email sent from one workload, it may affect other workloads using the same aggregation account's Amazon SES.
Therefore, this approach is not merely a change to the SMTP connection destination — it is a configuration change that also moves the Amazon SES sending infrastructure to the aggregation account.
When isolating SES sending quotas and reputation metrics per workload account
If you want to continue sending email from each workload account's Amazon SES, place Mail Manager-related resources in each workload account as well.
The configuration and email sending flow for each workload account are as follows.
Each workload account
Mail-sending application
↓ STARTTLS・SMTP AUTH
Mail Manager VPC endpoint
↓
Authenticated ingress endpoint
↓
Allowed or denied by traffic policy
↓ Allowed email
Rule set
↓
"Send to internet" action
↓ Executes SendRawEmail API with the permissions of the same workload account's IAM role
Amazon SES in the same workload account
↓
Sent to the internet
This set of resources is created for each workload account.
Workload account A
└─ Mail Manager and Amazon SES placed here
Workload account B
└─ Mail Manager and Amazon SES placed here
In this configuration, the following can be separated per workload account.
- SES verified identities
- Sandbox removal status
- Sending quotas
- Bounce rate
- Complaint rate
- Scope of impact from SES sending suspension
On the other hand, Mail Manager VPC endpoints and authenticated ingress endpoints are also required per workload account.
Therefore, the current VPC endpoint aggregation configuration cannot be maintained. Additionally, VPC endpoint costs and the number of resources to manage increase in proportion to the number of workload accounts.
Comparison of Proposed Configurations
The migration options are summarized as follows.
| Configuration | VPC endpoint | SES sending quotas and reputation metrics | IAM SMTP user | Main changes |
|---|---|---|---|---|
| Continue with traditional SES SMTP | Placed in aggregation account | Managed per workload account | Continue using | No configuration change |
| Place Mail Manager in each workload account | Placed in each workload account | Managed per workload account | Not needed | Create Mail Manager VPC endpoints, authenticated ingress endpoints, rule sets, IAM roles, etc. for each workload account |
| Place Mail Manager in the aggregation account | Placed in aggregation account | Managed in aggregation account | Not needed | SES verified identities, sending quotas, reputation metrics, etc. are also managed in the aggregation account |
If you want to maintain the current configuration as-is, you will continue using traditional SES SMTP.
Placing Mail Manager in each workload account allows isolating SES sending quotas and reputation metrics per workload account, but VPC endpoint aggregation cannot be maintained.
Placing Mail Manager in the aggregation account allows maintaining VPC endpoint aggregation, but SES sending quotas and reputation metrics will also be managed on the aggregation account side.
Summary
The current configuration of "VPC endpoints in the aggregation account, with SES sending quotas and reputation metrics isolated per workload account" cannot be migrated to Mail Manager SMTP as-is.
When migrating, you need to decide which of the following to prioritize.
- Maintaining VPC endpoints in the aggregation account
- Isolating SES sending quotas and reputation metrics per workload account
If you want to maintain both, continuing with traditional SES SMTP appears to be the best option at this time.
