How to Export Your Amazon WorkMail Mailboxes Before March 31, 2027

On March 31, 2027, AWS ends support for Amazon WorkMail, and after that you can't reach the WorkMail console or anything in it. Whatever you're moving to, take a full export first. It's your archive if a migration misses something, and it's the copy your accountant or lawyer will ask about later.

There are two ways to get mail out of WorkMail, and most organizations should use both:

• The mailbox export job writes each mailbox to a ZIP file in an S3 bucket you own. That's your archive.
• IMAP is how a new provider copies mail across. That's your migration. (See the exit checklist for the order of operations.)

This post covers the export job, plus the two things it doesn't save.

What the export job gives you

The StartMailboxExportJob API exports all email messages and calendar items from one mailbox to a .zip file in S3, in MIME format. The file is encrypted with a KMS key you provide. Contacts and tasks are not exported. The job runs over a period of time, so it isn't a snapshot of a single moment; mail that arrives during the export may or may not be in it.

There's no button for this in the console. It's an API call, so you'll need the AWS CLI and an administrator on the WorkMail organization.

What you need first

• An S3 bucket with public access blocked.
• A symmetric KMS key.
• An IAM role that the WorkMail export service (export.workmail.amazonaws.com) can assume, allowed to write to the bucket and use the key.
• All three in the same AWS Region as your WorkMail organization.

The role's permissions policy needs s3:PutObject, s3:AbortMultipartUpload and s3:GetBucketPolicyStatus on the bucket, and kms:GenerateDataKey and kms:Decrypt on the key. AWS's mailbox export guide has both policy documents ready to copy. Save them as mailbox-export-trust-policy.json and mailbox-export-policy.json, then:

aws iam create-role --role-name WorkmailMailboxExportRole \
  --assume-role-policy-document file://mailbox-export-trust-policy.json
aws iam put-role-policy --role-name WorkmailMailboxExportRole \
  --policy-name MailboxExport --policy-document file://mailbox-export-policy.json

Export one mailbox

You need your organization ID (it starts with m-, shown in the WorkMail console) and the user's ID:

aws workmail list-users --organization-id m-EXAMPLE \
  --query "Users[?State=='ENABLED'].[Id,Email]" --output table

Then start the job:

aws workmail start-mailbox-export-job \
  --organization-id m-EXAMPLE \
  --entity-id USER-ID \
  --kms-key-arn arn:aws:kms:us-east-1:111122223333:key/KEY-ID \
  --role-arn arn:aws:iam::111122223333:role/WorkmailMailboxExportRole \
  --s3-bucket-name my-workmail-archive \
  --s3-prefix exports/

And watch it:

aws workmail list-mailbox-export-jobs --organization-id m-EXAMPLE

When the state is COMPLETED, the ZIP is in the bucket, along with a short log of totals: messages, folders, bytes, and totalNonExportableItems, which counts what it skipped, like notes and contacts.

Export everyone

Repeat the start command for each user ID from list-users. Two limits shape how you do it:

• Up to 10 export jobs can run at once per organization, so go in batches of ten.
• Each mailbox can be exported once every 24 hours, so a retry after a mistake means waiting a day. Check your role and key on one mailbox before you queue the rest.

Large mailboxes take longer. Start in the fall, not in March.

Save contacts and calendars separately

Contacts aren't in the export at all, and calendar items come out as MIME, which no calendar app imports directly. The practical route is a desktop client that's connected to WorkMail:

• Classic Outlook for Windows: File → Open & Export → Import/Export → Export to a file. A .pst covers mail, calendar and contacts in one file.
• Apple Contacts: select all, then File → Export → Export vCard.
• Apple Calendar: File → Export → Export, which gives you an .ics file per calendar.

Google Workspace, Microsoft 365 and most other providers import vCard and .ics files directly.

When to run it

Run one export early, as a rehearsal and an archive. Run a final export after you've switched your MX records, once WorkMail has stopped receiving mail, and before you delete the organization. That last copy is the one that matches what you left behind.

An archive isn't a mailbox, though: you still need somewhere for tomorrow's email. If you'd rather it stay in your own AWS account, the way WorkMail did, that's what inbox.camp does. If not, here's every alternative, compared.