How to make AWS Pinpoint to use AWS SES from another account?

Step 1: Configure SES in the Shared Account Create an IAM Role in the Shared Account:

Go to the IAM console in the shared account.

Create a new role and select Another AWS account as the trusted entity.

Enter the account IDs of your Development and Staging accounts.

Attach the following policy to the role to allow sending emails through SES:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "arn:aws:ses:<region>:<shared-account-id>:identity/*"
    }
  ]
}

Update SES Sending Authorization Policy:

Go to the SES console in the shared account.

Navigate to Email Addresses or Domains under Verified Identities.

Select the identity you want to use (email address or domain) and go to its Authorization tab.

{
  "Version": "2012-10-17",
  "Id": "ExamplePolicy",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<dev-account-id>:root",
          "arn:aws:iam::<staging-account-id>:root"
        ]
      },
      "Action": "ses:SendEmail",
      "Resource": "arn:aws:ses:<region>:<shared-account-id>:identity/<domain-or-email>"
    }
  ]
}

Step 2: Configure IAM Policies in Development and Staging Accounts Create an IAM Role in Development and Staging Accounts: Go to the IAM console in each of the Development and Staging accounts.

Create a new role for Pinpoint to assume and select AWS service as the trusted entity and Pinpoint as the service.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::<shared-account-id>:role/<role-created-in-shared-account>"
    }
  ]
}

Step 3: Configure Pinpoint to Use SES Set Up Email Channel in Pinpoint:

Go to the Pinpoint console in the Development or Staging account.

Choose the project you want to configure.

In the left navigation pane, under Settings, choose Email.

For the Email identity, enter the verified email address or domain that was configured in the shared account.

For Sending authorization, enter the ARN of the role created in the shared account (from Step 1).

Shared Account IAM Role Trust Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<dev-account-id>:root",
          "arn:aws:iam::<staging-account-id>:root"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}


Development/Staging Account IAM Role Policy:


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::<shared-account-id>:role/<role-created-in-shared-account>"
    }
  ]
}