Direct Mail:Control resource access with RAM users

In a collaborative environment, create RAM users and assign them permission policies scoped to Direct Mail resources. This separates administrative duties, reduces the risk of unauthorized access, and keeps your primary account credentials off shared systems.

Grant Direct Mail permissions to a RAM user

Prerequisites

Before you begin, ensure that you have:

• Created a RAM user. For details, see Create a RAM user.

Grant permissions

Grant permissions to the RAM user using one of the following methods:

• Method 1 — Attach a managed policy to grant access to all Direct Mail resources. Choose this method when the RAM user needs broad access.

• Method 2 — Create a custom policy scoped to specific Direct Mail APIs. Choose this method when you need fine-grained, least-privilege access.

Method 1: Use a managed policy

Attach one of the following managed policies to the RAM user:

Method 2: Create a custom policy

1. Go to the visual editor to create a permission policy.

Alternatively, create a custom policy using the JSON editor. The following policy grants access to all Direct Mail actions:

    {
        "Version": "1",
        "Statement": [
            {
                "Action": "dm:*",
                "Resource": "*",
                "Effect": "Allow"
            }
        ]
    }

To restrict access to a single API, specify it in the Action field. The following example allows only the SingleSendMail operation:

    {
        "Version": "1",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "dm:SingleSendMail"
                ],
                "Resource": [
                    "acs:dm:*:*:*"
                ]
            }
        ]
    }

For policy syntax details, see Basic elements of a RAM policy.

1. Attach the custom policy to the RAM user.

Frequently asked questions