Document the required IAM permissions for SES email transport to work
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- Half a day
- Newbie friendliness
- 78/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- aws
- Domain
- documentation
Research direction
Start with the email configuration page's AWS SES section and review the original Directus issue linked in the report for the observed permissions and health-check behavior. Document the required ses:GetAccount and ses:SendRawEmail actions and the relevant SES identities, including invalid@invalid, so administrators can configure narrow IAM policies and understand when the health check succeeds.
Written by the indexing model from the issue text.
Description
Describe the Bug
It would be super helpful if the email config page includes, or references, the required IAM policy actions and resources required for EMAIL_TRANSPORT: ses to work, so that administrators can set very narrow IAM permissions boundaries. Through trial and error I discovered that the SES transport requires:
Actions:
ses:GetAccount
ses:SendRawEmail
Resources:
Identity that matches/includes the EMAIL_FROM address, but also:
An identity in the EMAIL_SES_REGION for invalid@invalid (🤷)
...for both email sending and the email health checks to work. Until I added that, password reset emails were sent out successfully but the /server/health/ endpoint returned a nondescript error response:
{
"errors": [
{
"message": "Converting circular structure to JSON\n --> starting at object with constructor 'IncomingMessage'\n | property 'req' -> object with constructor 'ClientRequest'\n --- property 'res' closes the circle",
"extensions": {
"code": "INTERNAL_SERVER_ERROR"
}
}
]
}
In my case, adding the missing ses:GetAccount action and invalid@invalid resource to my IAM policy fixed this.
To Reproduce
Create an IAM policy with ses:SendRawEmail but not ses:GetAccount and not the 'invalid@invalid' SES identity.
Set the EMAIL_TRANSPORT config value to ses and set the other required values.
Send a request to /server/health/.
Receive above error response.
Modify IAM permissions to include ses:GetAccount and the 'invalid@invalid' identity.
Restart Directus instance and send another request to /server/health.
Receive OK.
Originall created at: https://github.com/directus/directus/issues/27038
- Dominant language
- TypeScript
- Stars
- 22
- Forks
- 82
- Avg merge
- 18h 49m
- Merged PRs (30d)
- 4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from directus/docs
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
content-missing
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100