Using API Calls over an SES VPC Endpoint

Question

Hello,

I have found verification of this elsewhere on the Internet, so I wanted to post here to ask a "why" question.

I have code that is using the API call `send-templated-email` in a Lambda function. Recently, I locked down the VPC removing the Internet and NAT Gateways. While adding the various required VPC endpoints needed for my solution, I discovered that the API calls to SES are not available. SMTP sending is available, but my solution doesn't use it.

Any options for me besides moving this Lambda out of the VPC? Why this limitation? Seems a bit rare for what is normally complete and robust solutions from AWS.

Thanks

Answer

Yes, the Lambda is in the VPC in order to connect to a DB. The SES VPC Endpoint is only able to accept SMTP connections. It doesn't accept the API call to the normal `email..amazonaws.com` endpoint URL. The VPCE creates the endpoint at the `email-smtp..amazonaws.com` - SMTP only.

Because I am using the SES Template system, I can't use the code as written within the VPC. I have to move it out or set up a route out of the VPC with a NAT gateway, etc. In my case, this is all triggered on a SQS message, so I will move more onto the message to solve this.

I guess I am surprised by this omission. AWS is usually so thorough.

Thanks.

Using API Calls over an SES VPC Endpoint

Relevant content