Unable to send mail on an ECS fargate job using python SDK with credentials of a verified SES in another aws account

user_11922873 0
Viewed 257

I have a python app running in fargate ECS which sends emails. I have a verified SES in another account. I am trying to use these credentials in the python app , which runs in a different aws account than the verified SES. It uses the aws python sdk's ses module to create the boto3 ses object. The mailing works if I create a boto3 ses object within the main app , without using the sdk. But when I use the sdk it seems to be using the SES in the main account (which is sandboxed) although I pass the verified SES account's endpoint, access and secret access keys (these are stored as secure strings in my main account's parameter store).

What is the reason the sdk keeps using the main account's SES even if I supply it with credentials of the verified SES account? How can I fix this?

amazon-ses aws-fargate amazon-ecs aws-sdk python
1 Answers

That is because AWS Fargate also inject its own AWS environment into your container and it would be using the credential of the execution roles that you gave your tasks. So the hard coded environment will override your env's configuration.

The quickest solution is to name your SES's credentials differently in the parameter store. Go for something like

SERVER_AWS_ACCESS_KEY_ID=your-key
SERVER_AWS_SECRET_ACCESS_KEY=your-key
SERVER_AWS_REGION=your-region

instead of the conventional AWS credential declaration (Since it would be overridden)

AWS_ACCESS_KEY_ID=your-key
AWS_SECRET_ACCESS_KEY=your-key
AWS_REGION=your-region

And then in your code, you would need to initiate a new instance of the aws-sdk using the SERVER_AWS_ACCESS_KEY_ID, SERVER_AWS_SECRET_ACCESS_KEY and the SERVER_AWS_REGION that you have just saved.

user_66018730
Related