AWS - SES Not send e-mail - SUBNET

Question

I currently have a backend running in a container (ECS), this backend has a SES service for sending e-mail (user password recovery).

I implemented this same scenario using SUBNET for my backend, but sending e-mail is no longer working.

In both my old scenario (without using a subnet) and localhost, sending the email works perfectly.

I did a ping test from the container and got a timeout answer:

Problem with private subnet setting. Using private subnet you can access internal element but you can't access out side world email for sending email required public subnet group and gateway to reach there. — Avinash Dalvi, Jun 21 '20 at 19:53
@aviboy2006 But is there a possibility to put only the ses service (endpoint) to "public" and keep the rest private subnet? — rufus05, Jun 21 '20 at 20:04
are able to ping end point from ECS ? or public nat instance or gatway ? — Avinash Dalvi, Jun 21 '20 at 20:05
@aviboy2006 ping endpoint ECS = OK, public nat instance or gatway = NO ping — rufus05, Jun 21 '20 at 20:31
security group allow 0.0.0.0/0 traffic in all protocols, inbound and outbound rulez — rufus05, Jun 21 '20 at 20:46
i did traceroute in email.us-east-1.amazonaws.com and stop after IP - Interface for NAT Gateway — rufus05, Jun 21 '20 at 20:48
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/216391/discussion-between-aviboy2006-and-rufus05). — Avinash Dalvi, Jun 21 '20 at 21:13
Should the address be "email-smtp.us-east-1.amazonaws.com", as documented here?: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html — Matt D, Jun 22 '20 at 01:21

Matt D · Answer 1 · 2020-06-22T16:24:04.550

In this case it looks like you have the wrong address, you have email-smtp.us-east-1.amazonaws.com (email-smtp) defined on your endpoint, and email.us-east-1.amazonaws.com (email) in your ping. Remember that a Ping may not respond if ICMP is not allowed through.

For a wider answer to this question, you have 2 options:

Make sure that you have an Internet Gateway configured correctly on your Subnet, and the security group added to your ECS host allows outgoing traffic to port 25 (this is throttled by AWS), 587 or 2587 depending on what you are using to talk to SES: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-connect.html
Create an SES VPC Endpoint on your subnet, then direct all of your SES requests to this new endpoint/IP Address: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-set-up-vpc-endpoints.html

If any of these are not working, check:

You are not in SES Sandbox mode (raise a support request)
You are not being throttled on port 25 from your host (use port 587 or raise a support request)
You can connect to the internet from your EC2/ECS instance
Port 587 is enabled on your security group
The URL Address is correct (email-smtp.us-east-1.amazonaws.com)
The IAM Role on your EC2/ECS Host (or IAM User) is enabled for SES Sending.

AWS - SES Not send e-mail - SUBNET

1 Answers1