stuck in a loop getting SES out of the sandbox mode

Question

I have a number of IAM users with management console access, all tied to different client accounts.  One of those accounts happens to be an account with GovCloud access.  So I'll abstract it to say that IAM account A is linked to AWS account X with GovCloud access, and IAM account B is linked to AWS account Y.

I requested for SES in account X (the GovCloud account) to be moved from 'sandbox' to 'production'.  AWS created a ticket for this, and then responded that I had made the request from a non GovCloud account.  But even if I was simultaneously logged into one of my non GovCloud IAM accounts, how did I supposedly request that an SES setting for the GovCloud account get changed!?!?!  That makes no sense to me (i.e. that somehow IAM account B can request a settings change in an AWS account that it doesn't have access to).  But they continue to say in the ticket that they can't proceed, because I made the request from the wrong account.

Further complicating things, when logged into my GovCloud account, and am in the SES section, it says that the transition to production is pending, and that I need to provide more information in ticket XYZ.  But ticket XYZ is the ticket where I keep being told they can't do anything.  So I can't even re-submit the request to move to production.

Please help me make sense of what is going on, or how to just get our SES into production!!!!

Thanks in advance!

re:Post Agent · Answer

It sounds like you're experiencing a complex issue with moving your SES account out of the sandbox in a GovCloud environment. Let me help clarify what might be happening.

First, it's important to understand that sandbox status for Amazon SES is unique per AWS Region. When you request to move out of the sandbox, you need to make that request from the specific AWS account that owns the SES resources in question.

The confusion appears to stem from account access and permissions. Even though you have IAM users with access to multiple accounts, each SES production access request must be made from the specific account where SES will be used. In your case, that would be your GovCloud account (account X).

What likely happened is that you were logged into a non-GovCloud account (account B) when submitting the request, but attempted to request production access for the GovCloud account's SES. This isn't possible because one AWS account cannot request production access for another account's SES service.

To resolve this issue:

1. Make sure you're logged in specifically to your GovCloud account (account X) using the appropriate IAM credentials.

2. Navigate to the SES console within that GovCloud account.

3. Submit a new production access request directly from that account.

If the console shows that a request is pending and directs you to provide more information in a ticket that's not accessible, you may need to:

1. Check if you can cancel the current pending request through the SES console in your GovCloud account.

2. If that's not possible, you might need to create a new support case specifically from your GovCloud account to explain the situation.

Remember that while in the sandbox, your SES account is limited to sending only to verified email addresses, with a maximum of 200 messages per 24-hour period and 1 message per second. Getting out of the sandbox will remove these limitations, but you'll still need to verify all identities used as "From", "Source", "Sender", or "Return-Path" addresses.  
**Sources**  
[Moving out of the Amazon SES sandbox - Amazon Simple Email Service](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/request-production-access.html)  
[Request production access (Moving out of the Amazon SES sandbox) - Amazon Simple Email Service](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html)

stuck in a loop getting SES out of the sandbox mode

Add your answer

Relevant content