How do you monitor Amazon SES with CloudWatch alarms?

CloudWatch is the standard way to alert on anything in AWS, and SES publishes metrics to it. For a team that lives in AWS, it is the first thing to try.

The metrics

SES publishes counts such as sends, deliveries, bounces and complaints, and account-level reputation metrics for the bounce rate and complaint rate. The reputation metrics are the ones to alarm on, since they are the figures AWS reviews.

Setting one up

1. In CloudWatch, create an alarm on the SES reputation bounce-rate metric.
2. Choose a threshold below the AWS review line, for example half of it, so you have room to react.
3. Create an SNS topic and subscribe an email address or an endpoint.
4. Point the alarm at the topic.
5. Repeat for the complaint rate.

Where it stops

• Granularity. Reputation metrics are account-wide. They do not tell you which sender, domain or campaign is responsible.
• Detail. An alarm says a rate is high, not which recipients bounced or why.
• Other signals. Nothing watches your DNS records, suppression list growth or send-volume anomalies unless you build more alarms and more infrastructure.
• Delivery. Email from SNS is plain, and routing to Slack or Discord takes extra pieces such as Lambda functions.
• Upkeep. Alarms, topics and subscriptions are yours to maintain, and a broken subscription fails silently.

When it is enough

For a small account with one sender and a team that checks AWS daily, two alarms may be all you need. As the number of senders and domains grows, so does the work around the alarms. Compare it with Virtual Deliverability Manager, and read email deliverability monitoring for the full list of what is worth watching.