If you have an IAM user that you set up using the IAM interface, you need to do the following two steps to enable the user to send email using the Amazon SES SMTP interface:

* Derive the user's SMTP credentials from their AWS credentials using the algorithm provided in this section. A user's SMTP username is the same as their AWS Access Key ID, so you just need to generate the SMTP password.

* Apply the following policy to the IAM user:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":"Allow",
      "Action":["ses:SendEmail", "ses:SendRawEmail"],
      "Resource":"*"
    }
  ]
}
```

The following pseudocode shows the algorithm that converts an AWS Secret Access Key to an Amazon SES SMTP password.

```
key = AWS Secret Access Key;
message = "SendRawEmail";
versionInBytes = 0x02;
signatureInBytes = HmacSha256(message, key);
signatureAndVer = Concatenate(versionInBytes, signatureInBytes);
smtpPassword = Base64(signatureAndVer);
```