How do I resolve the “554 Access denied" error when I send an email from my IAM user in Amazon SES?

Resolution

To resolve the "554 Access denied" error, complete the following steps:

1. Open the IAM console.

2. In the navigation pane, choose Policies.

3. Choose the arrow next to each policy name associated with the IAM user to expand the policy details view.

4. Make sure that the IAM policy has permissions for the ses:SendEmail and ses:SendRawEmail actions. 
   The following example IAM policy allows the IAM user to send emails for the verified email address and domain identity:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ses:SendEmail",
                   "ses:SendRawEmail"
               ],
               "Resource": "*"
           }
       ]
   }

   In the preceding example policy, the IAM user has access to send email from all identities because the Resource element is set to "*". The Resource element can also specify an Amazon Resource Name (ARN) to restrict access to an AWS Region, domain, or email address. 
   Note: If an IAM policy doesn't exist, then create an IAM policy to grant you access to send emails.

5. Confirm there isn't a sending authorization policy attached to the email address or domain that prevents the IAM user from sending emails. If you verified the email address identity separately from the domain identity, then the authorization policy must allow the IAM user to send email. For more information, see Creating and verifying identities in Amazon SES.

6. If you use AWS Organizations, then review the service control policies (SCPs). Make sure that the SCPs don't contain any statements that explicitly deny the ses:SendEmail and ses:SendRawEmail actions or any other Amazon SES actions. Delete the SCPs that explicitly deny Amazon SES actions in accordance with your organization's security policies.
   The following example policy denies access to all Amazon SES actions:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Deny",
               "Action": "ses:*",
               "Resource": "*"
           }
       ]
   }

   Note: Amazon SES Simple Mail Transfer Protocol (SMTP) credentials are unique to each AWS account, and specific to one Region.

Related information

Identity and access management in Amazon SES

How do I resolve Amazon SES 554 or 400 "Message rejected" errors?

Amazon SES SMTP issues