Access Denied while sending email from AWS SES in Lambda function

Question

I am trying to send an email using Amazon SES in AWS Lambda function, For this i am facing the following error.

AccessDenied: User arn:aws:sts::XXXXX:assumed-role/lambda_basic_execution/awslambda_XXXX' is not authorized to performses:SendEmail' on resource `arn:aws:ses:us-west-2:XXX:identity/example@example.com'

I have granted permission for

"ses:SendEmail", "ses:SendRawEmail" for the IAM role.

Can you include the policy that you have applied to the *lambda_basic_execution* role? — Aegix, Jan 22 '16 at 15:01
Please find the below policies - { "Version": "2012-10-17", "Statement": [ { "Sid": "StmtXXXXXXXXX", "Effect": "Allow", "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Resource": [ "*" ] } ] } — RakeshKalwa, Jan 22 '16 at 17:31
For anyone still having trouble, you need to authorise the ec2/lambda role for SendEmail and SendRawEmail on *any* resource first (see Rakesh's comment/Nishith's answer), in addition to setting the SES identity policy to allow your role to send email. — mitchdav, Jun 16 '19 at 06:12

Nishith · Answer 1 · 2018-10-16T15:59:42.263

62

So, I was also having the same problem which Rakesh has explained but couldn't understand the steps he was saying to do so here is a detailed explanation with steps.

You need to do the following Security, Identity & Compliance -> IAM -> Roles -> select your lambda function -> then edit policy -> open it in JSON and add the below part

{
  "Effect":"Allow",
  "Action":[
    "ses:SendEmail",
    "ses:SendRawEmail"
  ],
  "Resource":"*"
}

or you can do as per requirement from these policy examples https://docs.aws.amazon.com/ses/latest/DeveloperGuide/control-user-access.html#iam-and-ses-examples-email-sending-actions also, you need to verify the email address first so don't forget that. Hope this helps everyone.

edited Oct 16 '18 at 15:59

answered Oct 16 '18 at 13:42

Nishith

928
9
13

1

For a more restrictive policy, you can set the specific arn of the SES identity (AND arn of the email template if you are using `ses:SendTemplatedEmail`): "Resource": [ "arn:aws:ses:us-east-1:01234:identity/example@gmail.com", "arn:aws:ses:us-east-1:01234:template/example-template" ] – David Liao Dec 06 '22 at 02:54
How did you learn that ses:SendRawEmail should be added also? – Serhii Kushchenko Dec 22 '22 at 15:27
@SerhiiKushchenko I don't remember exactly, but it should only be required if you are sending raw emails or emails with attachments. – Nishith Dec 26 '22 at 03:10

score 11 · Answer 2 · answered Jan 23 '16 at 18:38

11

After a long debugging i got the issue, "lambda_basic_execution" role need to be granted with permission to access "ses:SendEmail", "ses:SendRawEmail".

Where i was trying to grant permission for the new IAM role i have created, but lambda function is mapped to "lambda_basic_execution" so there is a mismatch.

Reference - http://docs.aws.amazon.com/ses/latest/DeveloperGuide/control-user-access.html#iam-and-ses-examples-email-sending-actions

answered Jan 23 '16 at 18:38

RakeshKalwa

671
2
6
16

5

Could you paste the final policy that worked for you? I am still having this issue as well. Thanks. – warren May 06 '16 at 22:09

score 11 · Answer 3 · answered Jul 17 '19 at 15:34

If you are configuring policies for a SAM Lambda or using a YAML configuration file, you would use something like this:

template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'your-email-lambda'

Resources:
  YourEmailFunction:
    Type: AWS:Serverless::Function
    Properties:
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - 'ses:SendEmail'
                - 'ses:SendRawEmail'
              Resource: '*'

score 4 · Answer 4 · answered Nov 08 '19 at 09:34

As what others said you should add this two permissions: ses:SendEmail,ses:SendRawEmail

I just want to add explaination for those who use Serverless framework

In serverless.yml:

provider:
  name: aws
  stage: dev
  runtime: nodejs10.x
  region: us-west-1
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
        - lambda:InvokeFunction
        - ses:SendEmail            # add this
        - ses:SendRawEmail         # add this
      Resource: '*'                # add this

score 2 · Answer 5 · answered Oct 20 '19 at 20:35

IAM Policy fixed the issue. Policy summary will show if there are any warnings i.e. resource does not exist etc.

JSON needs following

       {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": "*"
        }

score 2 · Answer 6 · answered Jan 12 '22 at 13:41

Solution: You got permission error. your lambda iam identity needs to implement this missing iam policy - right action ( ses:SendEmail ) and right effect ( Allow ) to gain access permissions to this resource ( verified domain - arn ). on terraform you can add the following iam policy:

  statement {
    actions   = ["ses:SendEmail"]
    effect    = "Allow"
    resources = ["arn:aws:ses:us-west-2:XXX:identity/example@example.com"]
    sid = "emailFromAWSLambdaServerlessMachine"
  }

As a result - your policy will look like following:

{
  "Effect":"Allow",
  "Action":[
    "ses:SendEmail"
  ],
  "Resource":"arn:aws:ses:us-west-2:XXX:identity/example@example.com",
  "Sid": "emailFromAWSLambdaServerlessMachine"
}

P.S try avoid applying * as a resource or an action and limit access as much as possible for mitigate a security risks.

This is the best answer, BUT one must know that SES initially operates in a restricted "sandbox" mode, so it will produce badly worded errors for a policy that specifies exact ARN. In order for this policy to work, SES must be moved out of sandbox mode by filling a special form. https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html?icmpid=docs_ses_console — donkz, Feb 21 '22 at 20:44

Zeke · Answer 7 · 2022-05-16T18:17:17.060

You have to create a policy in order to relate your IAM user with your email sender.

First you have to create the SMTP credentials. In your Account Dashboard go down and select Create SMTP Credentials Well, now you have the IAM user you are going to use it to send emails with SES. Copy the user ARN (something like this: arn:aws:iam::601688880060:user/ses-smtp-user.20227405-2043453), you will need it in the next step.

In your AWS SES account select your verified email you are going to use to send. Go to the Authorization tab. Create a Policy using the policy generator. There you have to paste there the user ARN. Check the options you want, apply policy.

To finish, add the credentials in your code. (you can also use a file named "credentials" in the ".aws" root directory)

$SesClient = new SesClient([
    'version' => '2010-12-01',
    'region'  => 'us-east-2',
    'credentials' => [
        'key'    => 'AKIAYYFKAU4OBNUT',
        'secret' => '9B9fuJIQdPFTkq5ZwR4b3OF3NsIAOwYtCv',
    ],  
]);

That's it, good luck !

score 0 · Answer 8 · answered Jul 08 '20 at 07:12

0

For Serverless Components yaml:

...
inputs:
  name: ${name}-${stage}
  region: ...
  service: lambda.amazonaws.com
  policy:
    - Effect: Allow
      Action:
        - ses:SendEmail
        - ses:SendRawEmail
      Resource: '*'

answered Jul 08 '20 at 07:12

Mark Simon

612
1
6
17

score 0 · Answer 9 · answered Jan 05 '23 at 19:02

I found @modsquadron's template.yaml answer didn't work, but this variation does - if you are configuring policies for a SAM Lambda, try:

template.yaml

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - Statement:
            - Sid: SESSendEmailToAllPolicy
              Effect: Allow
              Action:
                - 'ses:SendEmail'
                - 'ses:SendRawEmail'
                - 'ses:SendTemplatedEmail'
              Resource: '*'

score 0 · Answer 10 · answered Aug 17 '23 at 11:10

0

You can go to IAM > Users > and the user you have > Permissions and then under the Permissions boundary, I had the permissions boundary S3FullAccess then I changed it to SESFullAcess. It solved the problem for me

answered Aug 17 '23 at 11:10

PadmaBajra

23
4

Access Denied while sending email from AWS SES in Lambda function

10 Answers10

Linked