AWS SES Setup Simplified:From Hours to Minutes

The Problem: SES Setup is a Nightmare

Developer forums are filled with horror stories about AWS SES setup. The process involves navigating the AWS console, writing IAM policies by hand, configuring DKIM records, setting up event tracking pipelines, and managing credentials—all before you can send a single email.

The time investment is brutal. When you factor in engineer time, the cost of manual SES setup can dwarf the savings you get from AWS's low per-email pricing. Developers routinely spend full days just getting to the point where they can send a single test email.

The Solution: Infrastructure as Code, Zero Console

Wraps deploys production-ready email infrastructure to your AWS account using Pulumi under the hood. One command. No AWS console spelunking. No sandbox approval essays.

▋

That's it. In about 2 minutes, you have:

• SES configured with your domain
• DKIM, SPF, and DMARC ready for DNS
• Event tracking via EventBridge
• Email history in DynamoDB
• Lambda functions processing delivery events
• Proper IAM roles with least-privilege access
• OIDC authentication (no stored credentials)

See It In Action

Option 1: The CLI Path (Fastest)

Installation

Install the CLI globally or run it directly with npx:

npm install -g @wraps.dev/cli
# or just use npx
npx @wraps.dev/cli email init

Deploying Infrastructure

Run the init command and the CLI walks you through the entire process:

wraps email init

The CLI handles five steps automatically:

1. Credential validation – Confirms your AWS access
2. Preset selection – Choose Starter, Production, or Enterprise
3. Cost estimation – Shows estimated monthly AWS costs
4. Deployment – Pulumi provisions everything
5. OIDC setup – Configures credential-free access for Vercel

Command Options

wraps email init -p vercel -r us-east-1 -y

Adding Your Domain

Once infrastructure is deployed, add your sending domain. This creates the SES identity and returns DKIM tokens for DNS configuration.

wraps email domains add -d yourdomain.com

Verifying DNS Configuration

After adding DNS records, verify that everything is configured correctly. The CLI checks DKIM CNAME records, SPF TXT record, DMARC TXT record, and MAIL FROM MX records (if configured).

wraps email domains verify -d yourdomain.com

Managing Your Deployment

The CLI provides commands for every lifecycle stage of your email infrastructure:

# Check status of your infrastructure
wraps email status

# List all domains
wraps email domains list

# Upgrade to a higher tier
wraps email upgrade

# Remove everything (careful!)
wraps email destroy

Manual vs Wraps

Option 2: Understanding the IaC (What Gets Deployed)

Under the hood, Wraps uses Pulumi with @pulumi/aws to provision infrastructure. All resources are namespaced with wraps-email-* for easy identification. Here's the complete picture.

IAM Resources

SES Resources

Event Tracking Architecture

Every email event flows through a reliable, serverless pipeline. SES emits events to EventBridge, which routes them to SQS for buffered processing. A Lambda function reads from the queue and writes structured records to DynamoDB. Failed events land in a Dead Letter Queue for debugging.

Storage

Event Types Tracked

Resource Naming Convention

All Wraps resources follow the pattern wraps-email-{resource-type}. Every resource is tagged with ManagedBy: 'wraps-cli' so you can easily identify and audit Wraps-managed infrastructure in your AWS account.

Configuration Presets

Choose your deployment complexity based on your needs. Upgrade anytime with wraps email upgrade.

Sending Emails with the SDK

Once infrastructure is deployed, install the TypeScript SDK and start sending. The SDK is fully typed and handles credential resolution automatically.

npm install @wraps.dev/email

On Vercel, credentials are automatic via OIDC—no environment variables, no stored secrets. The SDK detects the runtime environment and acquires temporary AWS credentials transparently.

import { Wraps } from '@wraps.dev/email';

const wraps = new Wraps();

await wraps.emails.send({
  from: 'hello@yourdomain.com',
  to: 'user@example.com',
  subject: 'Welcome!',
  html: '<h1>Hello from Wraps!</h1>',
});

Vercel OIDC Integration

One of the nastier parts of AWS integrations is credential management. Wraps eliminates this entirely using OIDC federation.

How It Works

Vercel → OIDC Token → AWS STS → Temporary Credentials → SES

1. Your Vercel deployment requests an OIDC token
2. AWS STS validates the token and issues temporary credentials
3. The SDK uses those credentials to call SES
4. Credentials rotate automatically—nothing stored

Setup

During wraps email init, you'll be asked for your Vercel team slug and project name. These configure the OIDC trust relationship so your deployments can assume the IAM role without any stored secrets. See our Next.js + Vercel + SES guide for a complete walkthrough.

Connecting Existing SES

Already have SES configured? Wraps can layer on top without touching your existing setup:

wraps email connect

This command scans your existing AWS resources (SES domains, config sets), prompts for which features you want to add, and deploys Wraps resources non-destructively. It never modifies your existing configuration—all new resources are created with the wraps-email- prefix.

Troubleshooting

What You're Not Paying For

Traditional email APIs charge you per email sent, plus platform fees, plus storage fees. With Wraps, the model is different:

• You pay AWS directly for sending ($0.10 per 1,000 emails)
• Your data stays in your AWS account
• No vendor lock-in—your infrastructure keeps working even if you stop using Wraps

Design Principles

Every CLI decision follows these principles: