Docs
/
Contact supportLog inGet started
Platform
Integrations
Building in-app UI
API reference
CLI reference
Management API
Developer tools
Tutorials
Email
AWS SES

How to send email with AWS SES

How to send transactional email notifications to AWS SES with Knock.

Knock integrates with AWS Simple Email Service (SES) to send email notifications to your users.

In this guide you'll learn how to get started sending transactional email notifications with SES through Knock. We also cover provider configuration and additional data you can pass through to SES.

Features

  • Attachments support
  • Knock link and open tracking
  • Per environment configuration
  • Sandbox mode

Getting started

You can create a new AWS SES channel in the dashboard under the Integrations > Channels section. From there, you'll need to take some steps in AWS before you can configure your SES channel within Knock.

1

Verify a "From" address within AWS SES

You'll need to verify the "From" email address you plan on using to send emails with AWS if you haven't already. To do so, follow the steps outlined in AWS's guide to creating and verifying an email address identity.

2

Choose an AWS Authentication Scheme

Knock supports two authentication schemes with AWS SES:

To send notifications via AWS SES using an IAM User, Knock requires the access key ID and a secret access key of an AWS user with SES send permissions. (Specifically, the ses:SendEmail and ses:SendRawEmail permissions.)

If you don't already have a user with send permissions, you can create an IAM user in AWS to use with the Knock API. You can learn more about creating IAM users in AWS here.

Once you've created your new IAM user, you'll need to provision them with the policy below.

Now that you have an AWS user created and provisioned with SES send access, grab the access key ID and a secret access key of the user—we'll use these later when configuring the SES channel within Knock.

To send notifications via AWS SES by delegating an IAM Role in your AWS account to Knock, secured with an External ID:

  1. Create a new AWS Role:
  • For "Trusted Entity Type" choose "AWS Account."
  • Select "Another AWS account" and put "496685847699" in the Account ID.
  • Check "Require external ID" and enter the ID of the SES channel you created in your Knock dashboard.
How Knock works diagram
  1. Attach the following permission policy to that role.
  1. Use that role's ARN when configuring your AWS SES channel in Knock.
3

Configuring SES in Knock

Now that you have a verified "From" address and either an AWS User's credentials or an AWS IAM Role to delegate to Knock, you're ready to configure your SES channel in the Knock dashboard under the Integrations > Channels section.

Here are a few other things to keep in mind once you have your SES channel configured in Knock:

  • SES sandbox mode. By default, AWS places all new accounts in the SES sandbox. While your account is in the sandbox, you can only send emails to verified email address—keep this in mind if you're testing in development before you've moved your account out of the SES sandbox. For more information on the SES sandbox and how to move your account out of it, see the SES sandbox documentation.
  • Deliverability tracking. We cannot currently track deliverability through SES channels. This means that all notifications sent through SES will show up as "Sent" in the Knock messages log, but not "Delivered."

Channel configuration

The following channel settings should be configured per environment. Navigate to Integrations > Channels in your dashboard, select your AWS SES channel, then click "Manage configuration" under the environment that you'd like to configure.

Fields marked with an * are required.

Knock settings

Sandbox modeboolean
Whether to enable sandbox mode for your SES channel.
Knock open trackingboolean
Whether to enable Knock email-open tracking.
Knock link trackingboolean
Whether to enable Knock link-click tracking.

Provider settings for AWS SES

AWS regionenum*
The region your AWS account is in.
Authentication schemeenum*
The authentication scheme (Access Key or External ID) to use for your SES channel.
Access key IDstring*
The access key ID from your AWS account. Required when using Access Key authentication.
Secret access keystring*
The secret access key from your AWS account. Required when using Access Key authentication.
AWS IAM Role ARN to assumestring*
The ARN of the role in your AWS Account that this channel will use. Required when using External ID authentication.
External IDstring*
The external ID for your AWS IAM Role. Required when using External ID authentication.
From email addressstring | liquid*
The default sender email address (can use Liquid tags).
From namestring | liquid
The default sender name (can use Liquid tags).

When configured, these optional overrides will apply to all emails sent from this channel in the configured environment. Learn more about email channel overrides here.

Tostring | liquid
The To email address that email notifications will be sent to (can use Liquid tags). This value will override the designated recipient's email address.
Ccstring | liquid
The CC email address that email notifications will be sent to (can use Liquid tags).
Bccstring | liquid
The BCC email address that email notifications will be sent to (can use Liquid tags).
Reply-tostring | liquid
The reply-to email address that will be included on email notifications (can use Liquid tags).
Payload overridesJSON (string) | liquid
Provide a JSON object to merge into the API payload that is sent to the downstream provider.

Set optional per-environment conditions for this channel. These conditions are evaluated each time a workflow run encounters a step that uses this channel in the configured environment. If the conditions are not met, the step will be skipped.

Additional data sent

Knock sends the following attributes along with your emails (all as Tags):

  • Sender: always set to knock.app
  • knock_message_id: the ID of the message this email is associated with
  • knock_workflow: the key of the workflow this message was generated from
  • knock_recipient_id: the Knock ID of the recipient this email is being sent to

You can learn about the role of these SES attributes in the AWS Simple Email Service (SES) API documentation.

Recipient data requirements

In order to send an email notification you'll need a valid email property set on your recipient.