8

It is possible to use IAM credentials to allow to send mails from specific sender?

I mean, for example, I have two different domains and senders configurated into SES: info@example1.com and info@example2.com. Is there any way to limit a IAM user and its credentials to just send mails from info@example1.com?

I tried to specify a condition in a IAM policy defined into to the user permissions. However I could not find a condition that can solve my problem.

Also I tried to solve the issue using STMP credentials, but I have the same problem. Any ideas?

Pablo SL
  • 165
  • 1
  • 6
  • Could you post the policy you tried? – EFeit Jun 11 '13 at 14:05
  • This is the SES normal policy. I could not define any conditions because they are not applicable to my problem. { "Version": "2012-10-17", "Statement": [ { "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Sid": "Stmt1370533724000", "Resource": [ "*" ], "Effect": "Allow" } ] } – Pablo SL Jun 11 '13 at 15:48

2 Answers2

26

This may have changed since the original answer. You can now do something like:

{
    "Version": "2012-10-17",
    "Statement": [
     {
       "Effect": "Allow",
       "Action": ["ses:SendEmail"],
       "Resource":"*",
           "Condition": {
             "StringEquals": {
               "ses:FromAddress": "here@somewhere.com"
             }
         }
       }
    ] 
}

The AWS docs now reflect this: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/control-user-access.html

user2434027
  • 411
  • 4
  • 5
5

It is possible to use IAM credentials to allow to send mails from specific sender?

NO

See: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/control-user-access.html

You can't specify a particular Amazon SES resource in an IAM policy. You only control access to Amazon SES actions. Therefore, Amazon SES does not use Amazon Resource Names (ARNs), which identify resources in a policy. When you write a policy to control access to Amazon SES actions, you use * as the resource.

(emphasis mine)

You can control what API calls IAM accounts can make(like ses:SendEmail), but you can not restrict what parameters they can use with those API calls(like the source email address)

prestomation
  • 7,225
  • 3
  • 39
  • 37
  • You can though specify configuration-set when using `ses:SendEmail*` and particular configuration-set can be linked with a verified identity (a.k.a. sender) right? – kornicameister Feb 09 '22 at 11:31
  • This answer was from 2013, things have changed since then. as you point out. – prestomation Jun 05 '23 at 05:56