title: AWS: How to attach a policy to an IAM user that grants him the privilege to create a verified identity and not access root identities?
body: <p>In the <strong>root account</strong>, I have a <strong>verified domain identity</strong> that I used to create an <strong>email identity</strong> for transactional emails.<br />
  <a href="https://i.stack.imgur.com/BkC1q.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BkC1q.png" alt="enter image description here" /></a></p>
  <p>Now, I created a <strong>new IAM account</strong>.</p>
  <p>I would like to attach a <strong>policy</strong> to this <strong>IAM account</strong> that allows it to create a <strong>verified email identity</strong> using that <strong>verified domain identity</strong> in the root account.</p>
  <p>And he must <strong>not be able to list nor use</strong> the <strong>verified email identity</strong> in the root account.</p>
  <p>Should I use an <strong>inline policy</strong> for this (which I know should be avoided and left as a last resort) or <strong>normal permission configuration</strong>?<br />
  <a href="https://i.stack.imgur.com/fYFAz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fYFAz.png" alt="enter image description here" /></a></p>
  <p>If so how should I write or pick such a policy?</p>
  <hr />
  <p><strong>EDIT 1:</strong>
  When I tried to create an email using the <strong>IAM account</strong>, just to see what AWS would say, this is what's written in the notification:</p>
  <blockquote>
  <p>You do not have sufficient access to perform this action.</p>
  <p>User: arn:aws:iam::122443365328:user/iam-user-name is not
  authorized to perform: ses:CreateEmailIdentity on resource:</p>
  <p>arn:aws:ses:us-region:122443365328:identity/test@dmain_name.com because no
  identity-based policy allows the ses:CreateEmailIdentity action</p>
  </blockquote>
  <p>And when I searched for the <code>CreateEmailIdentity</code> in the inline policy creation dashboard, it was not found:</p>
  <p><a href="https://i.stack.imgur.com/66kId.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/66kId.png" alt="enter image description here" /></a></p>
  <hr />
  <p><strong>EDIT 2:</strong></p>
  <p>I have actually found it when I picked <code>SES-v2</code> as a service:</p>
  <p><a href="https://i.stack.imgur.com/2m2qa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2m2qa.png" alt="enter image description here" /></a></p>
  <p>I have granted the IAM user these privileges:</p>
  <p><a href="https://i.stack.imgur.com/NnM4z.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NnM4z.png" alt="enter image description here" /></a></p>
  <p>And in resources section:<br />
  <a href="https://i.stack.imgur.com/QGib8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QGib8.png" alt="enter image description here" /></a></p>
  <p>I added the <strong>ARN</strong> of the verified domain name:</p>
  <p><a href="https://i.stack.imgur.com/TvsDF.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TvsDF.png" alt="enter image description here" /></a></p>
  <p>This is the result:</p>
  <p><a href="https://i.stack.imgur.com/iU09K.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iU09K.png" alt="enter image description here" /></a></p>
  <p>But, still when I try to create an <strong>email identity</strong> using the <strong>IAM account</strong>, I still get this:</p>
  <blockquote>
  <p>You do not have sufficient access to perform this action. User:
  arn:aws:iam::12xxxxxx5328:user/iam-user-name is not authorized to
  perform: ses:CreateEmailIdentity on resource:
  arn:aws:ses:us-west-2:122443365328:identity/dev@domain_name.com
  because no identity-based policy allows the ses:CreateEmailIdentity
  action</p>
  </blockquote>
  <p>What I don't understand here is the meaning of not being authorized to perform <code>ses:CreateEmailIdentity</code> on the resource that I am trying to create which is the new email.</p>
  <p>How can I be authorized to do that on an <strong>email identity</strong> that still doesn't exist.</p>
  <hr />
  <p><strong>EDIT 3:</strong><br />
  Even after created an email using the <strong>root user</strong> and granted the <strong>IAM user</strong> the privilege of sending emails using that email using this policy:</p>
  <p><a href="https://i.stack.imgur.com/FfABL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FfABL.png" alt="enter image description here" /></a></p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;stmt1643366831422&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:aws:iam::12xxxxxx328:user/iam-user-name&quot;
        },
        &quot;Action&quot;: [
          &quot;ses:SendEmail&quot;,
          &quot;ses:SendRawEmail&quot;,
          &quot;ses:SendTemplatedEmail&quot;,
          &quot;ses:SendBulkTemplatedEmail&quot;
        ],
        &quot;Resource&quot;: &quot;arn:aws:ses:us-west-2:12xxxxxxxx28:identity/test2@domain_name.com&quot;,
        &quot;Condition&quot;: {}
      }
    ]
  }
  </code></pre>
  <p>When I send email in the backend, this is what gets logged:</p>
  <blockquote>
  <p> ~ file: emailServices.js ~ line 297 ~ .then ~ error AccessDenied:
  User <code>arn:aws:iam::12xxxxx5328:user/iam-user-name' is not authorized to perform </code>ses:SendEmail' on resource
  `arn:aws:ses:us-west-2:1xxxxx28:identity/domain_name.com'</p>
  </blockquote>
  <p>Then I authorized the iam user to send email on the <strong>Domain Identity</strong> using the same policy but applied on the <strong>Domain Identity</strong>.</p>
  <p>Now, sending emails using the IAM user credentials works.<br />
  The problem is that he can send emails using all <strong>verified email idenitities</strong>.<br />
  But, I want him to be able to do so by only using the <strong>corresponding email identity</strong> that was created specifically for that <strong>IAM user</strong>.</p>
  <hr />
  <p><strong>NOTE 1:</strong><br />
  I am aware that I should not use the root account and should instead only use IAM accounts.</p>