Skip to main content

AWS SES Marketing Automation with EventBridge and Step Functions (2026)

Email DeliverabilityUpdated Pon Pandian Paulswamy3 min read

Quick summary: When to keep Customer.io/Loops vs build journeys with EventBridge + Step Functions + SES: stream isolation, RFC 8058, Pro for DIPs, and a first-party journey architecture checklist.

Key Takeaways

  • io/Loops vs build journeys with EventBridge + Step Functions + SES: stream isolation, RFC 8058, Pro for DIPs, and a first-party journey architecture checklist
  • Migrating off Elastic Email, Resend Audiences, or a mid-market ESP often stalls on one question: who builds the journeys after the send API moves to Amazon SES
  • SES does not ship a drag-and-drop automation builder
  • As of July 21, 2026, SES pricing plans (Essentials / Pro / Enterprise) change how you buy dedicated IPs and Virtual Deliverability Manager
  • This guide is for platform engineers choosing among build (EventBridge + Step Functions + SES), buy (Customer
AWS SES Marketing Automation with EventBridge and Step Functions (2026)
Table of Contents

Migrating off Elastic Email, Resend Audiences, or a mid-market ESP often stalls on one question: who builds the journeys after the send API moves to Amazon SES? SES does not ship a drag-and-drop automation builder. As of July 21, 2026, SES pricing plans (Essentials / Pro / Enterprise) change how you buy dedicated IPs and Virtual Deliverability Manager. They do not add a marketer UI.

This guide is for platform engineers choosing among build (EventBridge + Step Functions + SES), buy (Customer.io / Loops / Klaviyo / Braze), and hybrid. Companion reading: SES for eCommerce, Elastic Email → SES, Resend → SES.

SES marketing automation on AWS means product events on EventBridge, journey orchestration in Step Functions, contact state in DynamoDB/RDS, and sends through SES configuration sets. RFC 8058 unsubscribe and mailbox-provider bulk-sender rules are production requirements, not backlog polish.

Build vs buy vs hybrid

We recommend hybrid for most product-led companies: marketer journeys on a purpose-built automation tool, SES for transactional and any promo volume where ESP unit economics break. Pure build wins when engineering already owns the contact model and marketers accept YAML/JSON journey changes (or you invest in an internal admin). Pure buy wins when weekly journey edits matter more than per-1k send cost.

PathChoose whenAvoid when
BuildFew stable journeys; eng owns contacts; AWS-native alreadyMarketers need weekly visual edits with no eng queue
BuyMarketing velocity is the bottleneckYou already pay ESP rates that dwarf eng cost at your volume
HybridTxn on SES; lifecycle on Customer.io/LoopsSplit From domains without DMARC alignment plan

Reference architecture

Product app / warehouse
        │  events (UserSignedUp, CartAbandoned, OrderPlaced)
        ▼
   EventBridge bus ──► rules ──► Step Functions (per journey family)
                                      │
                                      ├─ Wait / Choice / Parallel
                                      ├─ DynamoDB get/put (suppression, step state)
                                      ▼
                              SES SendEmail (config set: lifecycle|promo)
                                      │
                    bounce/complaint/open/click events
                                      ▼
                         SNS / EventBridge ──► suppression + journey flags

Quantified design constraint we use on checklists: treat one state machine per journey family (welcome, abandoned cart, win-back), not one machine with 40 branches. Operational blast radius stays reviewable; a failed welcome definition does not block cart recovery deploys.

Why EventBridge + Step Functions rather than cron + Lambda

  • EventBridge gives durable, filterable ingestion and partner integrations without custom queue glue for every producer.
  • Step Functions makes waits, retries, and human-readable execution history first-class, which matters when a cart wait is 1 to 72 hours and “sleep in Lambda” is not an option.
  • SES stays a dumb, cheap, observable send primitive with configuration-set isolation.

Deliverability requirements the builder must own

Mailbox providers do not care that your journey is “serverless.”

  1. SPF + DKIM + DMARC with alignment (Google/Yahoo Feb 2024; Microsoft May 5, 2025 for Outlook consumer bulk).
  2. RFC 8058 List-Unsubscribe + List-Unsubscribe-Post on marketing/lifecycle mail.
  3. Stream isolation: transactional vs lifecycle vs promo configuration sets; dedicated/managed DIPs when promo volume can poison txn reputation.
  4. Suppression before send inside the state machine, never “send then clean.”
  5. Plan-aware IP economics: a-la-carte DIPs ~$24.95/IP or managed DIP fees; Pro may undercut a packed a-la-carte stack (pricing plans).

Label complaint ceilings correctly: SES ~0.1% complaint risk vs Gmail Postmaster spam <0.10% vs published bulk-sender <0.3% guidance.

First-party artifact: journey checklist

The checklist encodes decision, identity/streams, event ingestion, orchestration, send path, feedback loop, and go-live, including a shadow-run gate that blocks SES until QA signs off. The reproducible outcome is a binary readiness gate you can attach to a PR.

Monday morning path

  1. Complete the journey architecture checklist.
  2. If build: scaffold one abandoned-cart state machine with Wait + suppression + SES; shadow-run without send.
  3. If hybrid: move only transactional to SES this sprint; leave marketer journeys on the ESP until auth domains are aligned.
  4. If promo volume needs DIPs/VDM: run the plan vs a-la-carte worksheet.
  5. For retail promo vs txn isolation patterns, see SES for eCommerce.

What this post doesn’t cover

  • Pixel-perfect parity with Klaviyo/Braze visual builders
  • Full CDK/Terraform modules for every journey (checklist first; IaC follows your account standards)
  • Consent / GDPR legal determinations
  • Cold outbound compliance (see SES B2B cold outreach)

Services: Amazon SES · SES migration.

Discuss your SES automation architecture →

Frequently asked questions

Can AWS SES replace Mailchimp or Customer.io for marketing automation?
SES replaces the send layer, not the visual journey builder. You can rebuild waits, branches, and triggers with EventBridge + Step Functions + a contact store, but marketers lose drag-and-drop editing unless you also build a UI. Many teams keep Customer.io or Loops for journeys and use SES for transactional or high-volume promo sends.
When should I NOT build marketing automation on Step Functions?
Skip the build if marketers change journeys weekly and engineering cannot staff that cadence, or if volume is low enough that an ESP’s all-in price is cheaper than eng weeks. Also skip a single mega state machine for every journey, because operational complexity grows faster than SES savings.
How do EventBridge and Step Functions work with SES?
EventBridge ingests product events (signup, cart abandoned, order placed). Step Functions orchestrates waits and branches, checks suppression, and calls SES SendEmail/SendBulkEmail (or a Lambda wrapper) with the correct configuration set. SES events (bounce, complaint, open, click) feed back into the contact store for later choices.
Do I need the SES Pro plan for marketing automation?
Not for the orchestration pattern itself. Pro matters when you need managed dedicated IPs and Global Virtual Deliverability Manager bundled, which is common for retail promo peaks. A-la-carte outbound remains $0.10/1k as of July 21, 2026; plans raise unit rates but can undercut stacked add-ons.
What could go wrong in a DIY SES journey?
Missing suppression checks before send, shared IPs between promo and transactional, absent RFC 8058 headers on marketing mail, and non-idempotent EventBridge rules that double-send after retries. Any of these can spike complaints faster than an ESP’s built-in guardrails would allow.
Is hybrid ESP + SES a valid architecture?
Yes. A common pattern is Customer.io/Loops/Klaviyo for marketer-owned journeys and SES for transactional plus high-volume campaigns with configuration-set isolation. Split only if authentication and From-domain strategy stay coherent across both.
Share:
Pon Pandian Paulswamy
Pon Pandian Paulswamy

Co-Founder, FactualMinds

Co-founder of FactualMinds. Builds tools for ecommerce brands and writes about how ecommerce really works, including the FactualMinds guides on Amazon SES: sending setup, authentication, IP warm-up, deliverability, and migrating from other email providers.

Ecommerce ToolsEcommerce OperationsAmazon SESEmail DeliverabilityEmail Authentication

Related AWS Services

Work with our certified AWS architects to implement the strategies covered in this article.

Amazon SES Consulting

High-volume transactional and marketing email with Amazon SES at a fraction of third-party ESP costs.

Learn more

SES Migration Services

Migrate from SendGrid, Mailgun, Postmark, or SparkPost to Amazon SES without deliverability risk.

Learn more

Recommended Reading

Explore All Articles »