To Prevent unauthorized user in EC2 to send out email via unauthorized SES credential

Question

Dear All,

I am researching how to prevent unauthorized users logged into EC2 server and send out email out using his SES smtp user account and email address?
I was thinking to disable those common port in the firewall rules?

Any one like to help to provide more solutions on it?

Answer

Put EC2 Instance into private Subnet, use SSM to connect to the instance instead of putting it on the public network, add least privileges to the IAM Role which is attached to the instance. 
Restrict access to SES using SCPs.

https://docs.aws.amazon.com/de_de/systems-manager/latest/userguide/ssm-agent.html
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

Answer

Coming from a last week security aws workshop, I would recommend to ll oil into Guardduty and integration with security hub https://docs.aws.amazon.com/guardduty/latest/ug/securityhub-integration.html

Answer

An unauthorized User access one EC2 in Environment A and send out email via SES using email-smtp.ap-southeast-1.amazonaws.com.
The credential account and verified identities belong to the authorized users AWS SES account.

How to prevent it?

To Prevent unauthorized user in EC2 to send out email via unauthorized SES credential

Relevanter Inhalt