Getting 403 error when trying to sendTemplatedEmail for template arn

0

Here is the policy for which I get 403 error when I tried to send email from X account on behalf of Y. The Y account has both idenity and template. X is able to access idenity but not template. this policy is added to lambda in account X { "Effect": "Allow", "Action": ["ses:SendTemplatedEmail", "ses:SendEmail"], "Resource": ["arn:aws:ses:${region}:${account_Y}:identity/${email_identity}", "arn:aws:ses:${region}:${account_Y}:template/TEMPLATE"] }

1개 답변
0

It's challenging to identify the root cause of the issue without having the specifics of your setup in both accounts. But typically, to authorize another account (Account X) to send emails on behalf of the identity that you own in another account (Account Y) you need to follow the Sending Authorization Process. This process relies on sending authorization policies. To enable a delegate sender to send emails on your behalf, you create a sending authorization policy and associate it with your identity using either the Amazon SES console or API. When the delegate sender attempts to send an email through Amazon SES on your behalf, the delegate sender passes the ARN of your identity in the request or in the header of the email.

When Amazon SES receives the request to send the email, it checks your identity's policy (if present) to determine if you have authorized the delegate sender to send on the identity's behalf. If the delegate sender is authorized, Amazon SES accepts the email; otherwise, Amazon SES returns an error message.

As a first step in troubleshooting, I recommend ensuring that you have followed the steps outlined in the following blog post:

https://aws.amazon.com/blogs/messaging-and-targeting/how-to-grant-another-ses-account-or-user-permission-to-send-emails/

profile pictureAWS
전문가
답변함 3달 전
profile picture
전문가
검토됨 2달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠