AWS SES case open from unknown email

Question

Hello,

I have discovered multiple open cases for AWS SES initiated by an unauthorized alternate contact. Upon investigation, I found that no new users or alternate contacts have been added to our account. This poses a significant security issue. How is it possible for an unauthorized individual to open cases within my organization?

How can I remove or ban this unauthorized contact to prevent further incidents?

Thank you.

Gary Mclean · Accepted Answer

* Using cloudtrail, change your region to N.Virginia.
* Under event history, set you Lookup attributes to Event name and search for CreateCase

Here you will see whos created the Cases. See if its a role in your account/IAM user etc which should help narrow down who created them

Helioz zipcpq · Answer

CloudTrail was activated today, so there are no previous logs.

Any other info?

Helioz zipcpq · Answer

Thanks for the clarification, you are right.

Cloudtrail is on by default and contains 90 days in the GUi. "Activating" CLoudtrail I assume is you just storing the events in S3/Cloudwatch - correct.

AWS SES case open from unknown email

Add your answer

Relevant content