Access to Application

It appears you're experiencing an authorization issue between Amazon WorkMail and Amazon SES (Simple Email Service). The error message indicates that the WorkMail service role doesn't have permission to perform the "ses:SendRawEmail" action, which is needed for sending emails.

This is likely a permissions issue that can be resolved by setting up the proper authorization policies. Here are some steps to troubleshoot and fix this:

1. Check if your SES account is still in sandbox mode. In sandbox mode, there are restrictions on who can send and receive emails.

2. Verify that you have properly set up sending authorization policies in SES to allow WorkMail to send emails on your behalf. You need to:

• Go to the SES console
• Navigate to "Verified identities"
• Select the identity you're trying to send from
• Go to the "Authorization" tab
• Create a policy that allows the WorkMail service role to perform the "ses:SendRawEmail" action

3. If you're the administrator, check that your WorkMail organization has the necessary permissions to use SES. WorkMail typically requires SES permissions to be properly configured.

4. Ensure that the email addresses or domains you're using are verified in SES.

If you continue to experience issues, you might need to contact AWS Support for more specific guidance related to your account configuration.
Sources
How Do I Set Up a Policy to Use SES | AWS re:Post
I do not have access to Mail Manager in SES | AWS re:Post

Hello,

I understand that you're encountering a permissions issue with Amazon SES.

Error Message: User 'arn:aws:sts::<account-id>:assumed-role/amazon-workmail-mailing-agent-us-east-1/...' is not authorized to perform 'ses:SendRawEmail' on resource.

The error message indicates that the WorkMail service role doesn't have permission to perform the "ses:SendRawEmail" action, which is needed for sending emails.

Workaround:

1. Check the IAM policy attached to the IAM user/role, which has necessary permissions to send emails.

Sample Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SESSendMail",
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": [
                "<arn-of-the-ses-identity>"
            ]
        }
}

⇒ Replace <arn-of-the-ses-identity> with the ARN of the SES identity on resource section.
.

2. Verify the SES Authorization policy attached to the identity, which is Explicitly denying to send emails by the identity. If there is explicit deny on the identity, the user/role should encounter the not authorized error message.

Either Remove the Explicit Deny statement on "ses:SendEmail" and "ses:SendRawEmail" actions. (OR)
Update the IAM policy to explicitly allow the identity to send emails, as mentioned below.

Sample Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Explicit allow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "<ARN-of-the-IAM-role>"
            },
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": "<arn-of-the-ses-identity>",
            "Condition": {}
        }
    ]
}

⇒ Replace <ARN-of-the-IAM-role> with the ARN of the IAM role on principal section. ⇒ Replace <arn-of-the-ses-identity> with the ARN of the SES identity on resource section.

Note: Ensure that the email addresses or domains you're using are verified in SES.
.
[+] Allowing Access to Email-Sending Actions Only - https://docs.aws.amazon.com/ses/latest/dg/control-user-access.html#iam-and-ses-examples-email-sending-actions

[+] Managing your identity authorization policies in Amazon SES - https://docs.aws.amazon.com/ses/latest/dg/managing-policies.html#managing-policies-console