Add Amazon SES API email delivery method
What does this MR do and why?
Adds Amazon SES API email delivery for self-managed GitLab, wiring up the :ses_v2 ActionMailer delivery method behind a new amazon_ses_mailer config block. This is the gitlab-org/gitlab portion of #604041 (closed); omnibus, CNG, docs, and testing are tracked in sibling tasks (#604042 (closed), #604043 (closed)).
Self-managed instances can now send email natively via the SES API, supporting both:
- static AWS access key + secret, and
- IAM role / instance-profile credentials (short-lived), resolved via assume-role → static keys → the AWS credential provider chain (env vars, shared profile, ECS, EC2).
The existing Microsoft Graph mailer initializer is merged into a single combined config/initializers/mailer_delivery_method.rb so the two GitLab-native delivery methods are mutually exclusive and fail fast at boot if both are enabled.
Note on Omnibus/CNG SMTP precedence
Rails loads config/initializers/* alphabetically. In Omnibus/CNG deployments, SMTP is configured via an injected config/initializers/smtp_settings.rb (symlinked from a cookbook template), which loads after mailer_delivery_method.rb and therefore takes precedence. The sibling Omnibus (#604042 (closed)) and CNG (#604043 (closed)) tasks must ensure smtp_settings.rb is not rendered when SES is enabled, and must match the amazon_ses_mailer settings key. A code comment in the initializer documents this.
References
Related to #604041 (closed)
How to set up and validate locally
-
Sign-up for an Amazon SES account, verify a domain, and generate an access key with SES permissions
-
Add verified email addresses you can test with in sandbox mode
-
Add the SES credentials to
gitlab.yml -
Send a test email in the Rails console:
[1] pry(main)> Notify.test_email('admin@mytestdomain.com', 'Test from GDK', 'Hello world!').deliver! Notify#test_email: processed outbound mail in 105.6ms => #<Mail::Message:161740, Multipart: false, Headers: <Date: Fri, 03 Jul 2026 15:54:36 +0800>, <From: GitLab <gdk@mytestdomain.com>>, <Reply-To: GitLab <gdk@mytestdomain.com>>, <To: admin@mytestdomain.com>, <Message-ID: <6a476abc8e34b_f95541003f1@heinrich--20250428-K3JCW.mail>>, <Subject: Test from GDK>, <MIME-Version: 1.0>, <Content-Type: text/html; charset=UTF-8>, <Content-Transfer-Encoding: 7bit>, <Auto-Submitted: auto-generated>, <X-Auto-Response-Suppress: All>, <ses-message-id: 0100019f26f8f3ed-23f7ee3f-e223-4df2-8cdf-9198f746ee91-000000>>
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.