How to set AWS SES identity in Laravel 8

user_6656422 0
Viewed 971

I am getting the error message User arn:aws:iam:blabla:user/blabla is not authorized to preform ses:SendRawEmail on resource arn:aws:ses:locationLblabla:identity/[domain-of-the-to-address].com my DevOps informs me that [domain-of-the-to-address] should me a specific/our domain. The only way I can find to manipulate that is changing the to address. How do i properly set that? I have tried that following

// services.php

return [
  'ses' => [
    'key' => '...',
    'secret' => '...',
    'region' => '...',
    'options' => [
      'SourceARN' => 'arn:aws:ses:locationLblabla:identity/[correct-domain].com'
      'Source' => 'test@[correct-domain].com'
    ],
  ]
];

and

// MyMailable.php

$this->withSwiftMessage(function (Swift_Message $message) {
  $message->getHeaders()->addTextHeader('X-SES-SOURCE-ARN', 'arn:aws:ses:locationLblabla:identity/[correct-domain].com');
});

Edit: In other words. I DO have the ses:SendRawEmail permission. I'm sending an email like: to: joe-bob@gmail.com from: do-not-reply@my-comp.com

but some how laravel driver or aws sdk is getting it backwards setting my identity as arn:aws:ses:locationLblabla:identity/gmail.com not arn:aws:ses:locationLblabla:identity/my-comp.com and we don't and wouldn't have an identity setup in out aws for ever single email domain with the ses:SendRawEmail so it won't work.

amazon-ses laravel amazon-web-services php
2 Answers

I don't believe you need the extra config options or the extra text header. It sounds like your SES account is still in the SES Sandbox mode. SES accounts are automatically placed in Sandbox mode when they're created and need to be requested to move out of Sandbox mode.

I'm assuming you've verified the email address or domain you're sending email FROM. However, while in Sandbox mode, you also have to verify the email address or domain you're sending TO. Or, if you can't do that, you can send your test emails to the SES mailbox simulator (success@simulator.amazonses.com).

For more information on Sandbox mode, its restrictions, and how to move out of it when ready, you can visit https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html.

For more information on the SES mailbox simulator, you can visit https://docs.aws.amazon.com/ses/latest/dg/send-email-simulator.html.

user_35831820

This is an IAM error, can you confirm the IAM user for the AWS Key/Secret you're using has the ses:SendRawEmail assigned to it, or alternatively, is there an IAM role granting access to ses:SendRawEmail on the Instance/Lambda your code is running from?

Make sure the IAM permission doesn't have any limits against it which could result in it not applying (such as only being applicable to certain servers/tags/IPs/SES identities...).

Sounds like you've verified your domain within SES already, so as long as you've been approved by AWS to leave the Sandbox, then you should be good to send as soon as that IAM issue is resolved.

user_12043510
Related