Hello, I'm wondering what you'd recommend to configure the email on a self hosting installation following https://www.medplum.com/docs/self-hosting/install-on-ubuntu ? I didn't find anything on the official documentation. After trying some things around I've managed to do as following : - Configure my domain on AWS SES - Create an IAM user and give him access to Amazon SES Service - Get credentials - On my VM modify the medplum.service that can be found in /usr/lib/systemd/system Environment=AWS_ACCESS_KEY_ID=AKI********** Environment=AWS_SECRET_ACCESS_KEY=fT8YB4********************************** Environment=AWS_REGION=eu-central-1 Relaunch system-daemon and medplum :

sudo systemctl daemon-reload
sudo systemctl restart medplum

It looks like this is working correctly, but I'm wondering what are the downside and what is the actual recommended solution to handle the emails with amazonses ? Is there any risk of loosing the environnement variable that have been manually added if I upgrade medplum for example ? Thank you.

Hi @thomabig, Your approach is functional, but there are some important considerations and better practices for configuring email with Medplum and AWS SES. ## Issues with your current approach: Environment variables in systemd service files can be overwritten during Medplum updates if the package manager replaces the service file. This is a valid concern. Security risk - AWS credentials are stored in plain text in a system file that may be readable by other users or processes. ## Recommended solutions: ### 1. Use a dedicated configuration file Create a separate environment file that won't be touched by updates:

bash
# Create environment file
sudo mkdir -p /etc/medplum
sudo touch /etc/medplum/medplum.env
sudo chmod 600 /etc/medplum/medplum.env

Add your credentials to `/etc/medplum/medplum.env`:

AWS_ACCESS_KEY_ID=AKI****
AWS_SECRET_ACCESS_KEY=fT8YB4****
AWS_REGION=eu-central-1

Then modify the systemd service to reference this file:

ini
[Service]
EnvironmentFile=/etc/medplum/medplum.env

### 2. Use IAM roles (preferred for EC2) If your VM is an EC2 instance, the most secure approach is using IAM roles: - Create an IAM role with SES permissions - Attach the role to your EC2 instance - Remove the AWS credentials from your configuration entirely This eliminates credential management and is more secure. The IAM role approach is generally recommended for production deployments as it's more secure and doesn't require credential rotation. Your current method works but should be moved to a separate configuration file to prevent loss during updates.

Thank you for your answer ! I'll have a look at this.