Skip to content

AWS SES / SMTP

Sources: Configure AWS SES for RaaS (TRIB 19294846977) · Create RaaS customer SMTP access (TRIB 19601490229)

RaaS uses AWS Simple Email Service (SES) in the raas-management account to send Rhapsody notification emails on behalf of customers. SES is used for outbound delivery; SMTP credentials are stored in each customer's AWS Parameter Store.

Production SES Regions

The following regions have SES out of sandbox with raas.rhapsody.global verified:

Region Purpose
eu-west-2 (London) UK customers (HSCN, Westherts, Christie, etc.)
eu-central-1 (Frankfurt) European customers (non-UK)
us-west-2 (Oregon) US West and Canada
us-east-1 (N. Virginia) US East
us-east-2 (Ohio) US Central
ap-southeast-2 (Sydney) Australia
eu-west-1, eu-west-3, eu-north-1, me-south-1, ca-central-1 Additional verified regions

Choosing the Right SES Endpoint

SES Endpoint Use For
email-smtp.eu-west-2.amazonaws.com UK customers
email-smtp.eu-central-1.amazonaws.com European customers (non-UK)
email-smtp.us-west-2.amazonaws.com US and Canada customers
email-smtp.ap-southeast-2.amazonaws.com Australian customers

Setting Up SES for a New AWS Account

1. Move SES Out of Sandbox

New AWS accounts start with SES in sandbox mode (can only send to verified addresses). To go production:

  1. Go to AWS SES console → Account dashboard → Request production access
  2. Fill in:
  3. Mail type: Transactional
  4. Website URL: https://lyniate.com
  5. Use case: Use to send notification messages from our integration engine for alerts
  6. Submit — AWS typically approves within 24 hours

2. Verify the Domain

  1. SES Console → Verified identities → Create identity
  2. Settings:
  3. Identity type: Domain
  4. Domain: raas.rhapsody.global
  5. DKIM signing key length: RSA_2048_BIT
  6. Publish DNS records to Route53: ✅ Enabled (automatically adds DKIM DNS records)
  7. DKIM signatures: ✅ Enabled

Note

If the domain is hosted in a different AWS account or DNS provider, uncheck "Publish DNS records to Route53" and add the DKIM entries manually.

Create Customer SMTP Credentials

Use the Ansible Tower job template:

Tower → Templates → Create RaaS customer SMTP access
Direct link

What this playbook does: - Creates an SES identity and associated IAM permissions for the customer - Allows the customer to send emails through SES via SMTP - Stores the generated SMTP username and password in the customer's AWS Parameter Store

The Ansible playbook: rhapsody-ses-credentials.yml in deploy-raas.

Proxy Note for Rhapsody Communication Points

Outbound HTTP/HTTPS connections from RaaS go through the proxy server. SMTP using port 587 (STARTTLS) should also be configured with:

Proxy Type: HTTP
Proxy Hostname: proxy.service
Proxy Port: 3128