SPF
Add include:amazonses.com to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.
DKIM
Found in the SES console, under Verified identities, then the domain, then DKIM.
SES uses Easy DKIM by default, publishing three CNAME records that Amazon manages and rotates for you. Take that option rather than the manual key.
Amazon SES publishes keys under a selector Amazon generates per identity, which is what an external check looks for.
DMARC
DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports, authorise everything legitimate, and only then tighten. The DMARC guide covers the order, and the order is what stops you blocking your own invoices.
Worth knowing with Amazon SES
SES is almost always used for transactional mail rather than mailboxes, and is usually configured by a developer for one feature. It is one of the most common includes left in an SPF record long after the feature moved elsewhere.
Watch the lookup count
Every include costs one of your ten SPF lookups, and so does every include inside it. Adding a third or fourth sender is where domains typically cross the limit, after which the whole record fails silently. See the lookup guide before adding another.