Amazon SES with AWS CDK: Identity, Template, and Test Email

Use CDK's ses.EmailIdentity to register a sender and ses.CfnTemplate to define message content. Complete identity verification, then send the message through SES separately. Stack synthesis should describe infrastructure, not send emails as a side effect.

Define the SES resources

In an AWS CDK v2 TypeScript app, instantiate this stack from the app entry point. Replace the example sender with an address you control before deploying.

COPY
import { CfnOutput, Stack, StackProps } from "aws-cdk-lib";
import * as ses from "aws-cdk-lib/aws-ses";
import { Construct } from "constructs";

export class SesStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);
    const identity = new ses.EmailIdentity(this, "Sender", {
      identity: ses.Identity.email("sender@example.com"),
    });
    const template = new ses.CfnTemplate(this, "GreetingTemplate", {
      template: {
        templateName: "CdkDemoGreeting",
        subjectPart: "Hello, {{name}}",
        textPart: "Hello, {{name}}. This is the SES demo.",
        htmlPart: "<p>Hello, {{name}}. This is the SES demo.</p>",
      },
    });
    new CfnOutput(this, "IdentityArn", { value: identity.emailIdentityArn });
    new CfnOutput(this, "TemplateName", { value: template.ref });
  }
}

The example targets CDK 2.272.0 and constructs 10.5.0. The EmailIdentity API supports email and domain identities. This example uses an email so the verification step is visible; a production domain identity additionally needs DNS configuration and deliverability planning.

Run npx tsc --noEmit, npx aws-cdk synth, and npx aws-cdk diff before npx aws-cdk deploy. This revision has not been deployed and no message has been sent during validation.

Complete verification in the deployment region

Open the verification email at your chosen sender address and follow its link. Check the identity status in the same SES region as the stack. A successful CloudFormation deployment is not evidence that identity verification or production sending access is complete.

AWS's verified identities guidance explains the sender and sandbox recipient requirements. An IAM policy alone cannot verify ownership of an address.

Send a deliberate test message

Save email.json, using the actual verified sender:

COPY
{
  "Source": "sender@example.com",
  "Destination": { "ToAddresses": ["success@simulator.amazonses.com"] },
  "Template": "CdkDemoGreeting",
  "TemplateData": "{\"name\":\"Reader\"}"
}

When you are ready to send the test, run:

COPY
aws ses send-templated-email --region YOUR_REGION --cli-input-json file://email.json

This command sends mail; it is not a preview. The simulator is intended for testing SES handling, not proving delivery to your own inbox. A returned MessageId means SES accepted the request, not that every later delivery step succeeded.

The caller needs ses:SendTemplatedEmail permissions for the intended identity. A deployed Lambda or service should use an execution role with scoped permissions. The identity ARN output is an identifier, not a credential. See IAM permissions with CDK for policy concepts and the distinction between users and workload roles.

Troubleshoot and clean up

For production, configure DKIM, domain authentication, bounce and complaint processing, and sending-limit monitoring. Do not treat this small example as a deliverability setup.

Review npx aws-cdk destroy only for the example stack. Removing its template or identity will affect applications still using them; check dependents first. Use CDK outputs to locate deployed identifiers.