Add Amazon SES API email delivery method

What does this MR do and why?

Adds Amazon SES API email delivery for self-managed GitLab, wiring up the :ses_v2 ActionMailer delivery method behind a new amazon_ses_mailer config block. This is the gitlab-org/gitlab portion of #604041 (closed); omnibus, CNG, docs, and testing are tracked in sibling tasks (#604042 (closed), #604043 (closed)).

Self-managed instances can now send email natively via the SES API, supporting both:

  • static AWS access key + secret, and
  • IAM role / instance-profile credentials (short-lived), resolved via assume-role → static keys → the AWS credential provider chain (env vars, shared profile, ECS, EC2).

The existing Microsoft Graph mailer initializer is merged into a single combined config/initializers/mailer_delivery_method.rb so the two GitLab-native delivery methods are mutually exclusive and fail fast at boot if both are enabled.

Note on Omnibus/CNG SMTP precedence

Rails loads config/initializers/* alphabetically. In Omnibus/CNG deployments, SMTP is configured via an injected config/initializers/smtp_settings.rb (symlinked from a cookbook template), which loads after mailer_delivery_method.rb and therefore takes precedence. The sibling Omnibus (#604042 (closed)) and CNG (#604043 (closed)) tasks must ensure smtp_settings.rb is not rendered when SES is enabled, and must match the amazon_ses_mailer settings key. A code comment in the initializer documents this.

References

Related to #604041 (closed)

How to set up and validate locally

  1. Sign-up for an Amazon SES account, verify a domain, and generate an access key with SES permissions

  2. Add verified email addresses you can test with in sandbox mode

  3. Add the SES credentials to gitlab.yml

  4. Send a test email in the Rails console:

    [1] pry(main)> Notify.test_email('admin@mytestdomain.com', 'Test from GDK', 'Hello world!').deliver!
    Notify#test_email: processed outbound mail in 105.6ms
    => #<Mail::Message:161740, Multipart: false, Headers: <Date: Fri, 03 Jul 2026 15:54:36 +0800>, <From: GitLab <gdk@mytestdomain.com>>, <Reply-To: GitLab <gdk@mytestdomain.com>>, <To: admin@mytestdomain.com>, <Message-ID: <6a476abc8e34b_f95541003f1@heinrich--20250428-K3JCW.mail>>, <Subject: Test from GDK>, <MIME-Version: 1.0>, <Content-Type: text/html; charset=UTF-8>, <Content-Transfer-Encoding: 7bit>, <Auto-Submitted: auto-generated>, <X-Auto-Response-Suppress: All>, <ses-message-id: 0100019f26f8f3ed-23f7ee3f-e223-4df2-8cdf-9198f746ee91-000000>>

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Heinrich Lee Yu

Merge request reports

Loading
Loading