iamRoleArn

The ARN of the IAM role to be used by Amazon Simple Email Service while writing to the Amazon S3 bucket, optionally encrypting your mail via the provided customer managed key, and publishing to the Amazon SNS topic. This role should have access to the following APIs:

• s3:PutObject, kms:Encrypt and kms:GenerateDataKey for the given Amazon S3 bucket.

• kms:GenerateDataKey for the given Amazon Web Services KMS customer managed key.

• sns:Publish for the given Amazon SNS topic.

If an IAM role ARN is provided, the role (and only the role) is used to access all the given resources (Amazon S3 bucket, Amazon Web Services KMS customer managed key and Amazon SNS topic). Therefore, setting up individual resource access permissions is not required.