How to Setup Amazon Web Services with SAP Marketing Cloud?

Setting Up Amazon Web Services with SAP Marketing Cloud

Written by: Robert Hassel, CX Consultant

Integration of Amazon Web Services and SAP Marketing Cloud provides sending emails via your email (Gmail, Hotmail,…) and also collects information about for example delivery and opening email, hard and soft bounces …

Prerequisites

SAP Marketing Cloud (SAP MC), Amazon WEB Services (AWS) account

Procedure

First, after logging into AWS, you have to create and verify sender email addresses under Simple Email Service -> Identity Management -> Email Addresses.

After creating the email address, you need to click on the address and go to Notifications -> Edit Configuration -> Click here to create a new Amazon SNS topic.

Now you need to create SNS topic for bounces and complaints, his name may be for example AMAZON_MARKETING.

When your SNS topic is created, you can assign your topic to your email. Go back to Simple Email Service -> Choose your email -> Notifications -> Edit Configuration -> SNS Topic Configuration. For Bounces and Complaints assign your SNS Topic and disable Email Feedback Forwarding, then press Save Config.

After these steps, create a new queue with the same name as your SNS Topic. Go to Simple Queue Service -> Create New Queue. Enter your name and choose Standard Queue and then press Quick-Create Queue.

Go to Identity and Access Management (IAM) -> Groups -> Create New Group. Group name can be for example Admins and assign Administrator Access from Attach Policy, then press Create Group.

Now you can create new IAM users. With IAM user you can control the permissions and authorizations. Go to Identity and Access Management (IAM) -> Users -> Add user. Create user AmazonSES with access type Programmatic access and assign a previously created group. After creating a user you receive parameters Amazon Access Key ID and Secret Access Key. These parameters we’ll need in SAP Marketing Cloud(Communication Systems and Communication Arrangements). Repeat this step for second user AmazonSQS, but use access type Console Password with Custom Password.

Go to https://email.eu-west-1.amazonaws.com/ in Chrome and open developer tools with F12. Under Security press View Certificate -> Details and save all available certificates in Base-64. Repeat this step also for https://sqs.eu-west-1.amazonaws.com/. Eu-west-1 is an example, your region of amazon services can be different.

After these 8 steps, we can move to SAP Marketing Cloud.

As admin in SAP Marketing Cloud open Maintain Certificate Trust List app and choose Add. Upload all certificates for email.eu-west-1 and also sqs.eu-west-1.

Go to Communication Systems app and create 2 systems: 

a.) System for Amazon SES with:

• System ID: AMAZON SES
• Host name: email.eu-west-1.amazonaws.com
• Users for Outbound Communication: User Name – Amazon ACCES key ID of Amazon SES, Password – Secret Access key of user AmazonSES

b.) System for Amazon SQS with:

• System ID: AmazonSQS
• Host name: sqs.eu-west-1.amazonaws.com
• Users for Outbound Communication: User Name – AmazonSQS, Password – user password of AmazonSQS

Then Go to Communication Arrangement and choose New:

a.) Communication Arrangement for Emails:

• Scenario: SAP_COM_0016
• Communication System: AmazonSES
• Provider ID: sapAmazon
• Sender Profile ID: your sender profile (If you don’t have it, you have to create it)
• Marketing Area ID: usually Global
• Port: 443
• Service URL: https://email.eu-west-1.amazonaws.com:443/

b.) Communication Arrangement for Bounce Handling:

• Scenario: SAP_COM_0039
• Communication System: AmazonSQS
• Provider ID: sapAmazon
• Sender Profile ID: your sender profile (If you don’t have it, you have to create it)
• Marketing Area ID: usually Global
• Port: 443
• Service URL: https://sqs.eu-west-1.amazonaws.com:443/
• Path: is the last individual portion of the queue URL at Amazon. For example /112255779176/AMAZON_MARKETING

After saving the arrangement, you can check the connection in the arrangement. If the connection is OK, we are done. If the connection isn’t OK, check the whole procedure again or contact me.