Amazon SES异常：IAM用户无权对资源执行“SES:SendRawEmail”

Question

我是AWS新手，我尝试使用Elastic beanstalk在AWS EC2实例中部署Springboot应用程序。我想利用AWS SES服务向订阅的应用程序用户发送通知。

作为其中的一部分，在AWS SDK SES API和IAM凭据的帮助下，我能够使用springboot应用程序发送验证用户电子邮件，但我也想发送未验证用户的电子邮件，因此，我已请求AWS支持团队将我的IAM用户从AWS SES沙箱中解救出来，并增加每天发送电子邮件的限制，AWS支持团队已满足此请求。

在将我的IAM用户移出SES沙箱后，当我尝试为已验证和未验证的用户发送电子邮件时，我遇到以下错误。

org.springframework.mail.MailSendException: Failed messages: com.amazonaws.services.simpleemail.model.AmazonSimpleEmailServiceException:
 User `arn:aws:sts::4***436****2:assumed-role/aws-elasticbeanstalk-ec2-role/i-066edeefc2ed72b10' is not authorized to perform 
 `ses:SendRawEmail' on resource `arn:aws:ses:ap-south-1:4***436****2:identity/ra******[e-mail]' 
 (Service: AmazonSimpleEmailService; Status Code: 403; Error Code: AccessDenied; Request ID: 5eeb1f17-a283-4d9f-bca9-ac981ee546c4; 
 Proxy: null); message exception details (1) are:

Failed message 1:
com.amazonaws.services.simpleemail.model.AmazonSimpleEmailServiceException: 
User `arn:aws:sts::4***436****2:assumed-role/aws-elasticbeanstalk-ec2-role/i-066edeefc2ed72b10' is not authorized to perform 
`ses:SendRawEmail' on resource `arn:aws:ses:ap-south-1:4***436****2:identity/ra******[e-mail]@gmail.com' 
(Service: AmazonSimpleEmailService; Status Code: 403; Error Code: AccessDenied; Request ID: 5eeb1f17-a283-4d9f-bca9-ac981ee546c4; Proxy: null)

波姆。xml:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-aws</artifactId>
    <version>2.2.1.RELEASE</version>
</dependency>
<dependency>
    <groupId>com.amazonaws</groupId>
    <artifactId>aws-java-sdk-ses</artifactId>
    <version>1.11.777</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-mail</artifactId>
    <version>2.2.6.RELEASE</version>
</dependency>

AWS邮件配置类：

import org.springframework.cloud.aws.mail.simplemail.SimpleEmailServiceJavaMailSender;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.mail.javamail.JavaMailSender;

import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.simpleemail.AmazonSimpleEmailService;
import com.amazonaws.services.simpleemail.AmazonSimpleEmailServiceClientBuilder;

@Configuration
public class AwsMailConfig {

  // Used to fetch AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
  private CustomPropertyConfig customPropertyConfig;

  public AwsMailConfig(final CustomPropertyConfig customPropertyConfig) {
    this.customPropertyConfig = customPropertyConfig;
  }

  @Profile("prod")
  @Bean("AWSCredentialsProvider")
  public AWSCredentialsProvider amazonAWSCredentialsProviderProduction() {
      return new EC2ContainerCredentialsProviderWrapper();
  }

  @Bean
  @Profile("prod")
  public AmazonSimpleEmailService amazonSimpleEmailServiceProduction() {

    return AmazonSimpleEmailServiceClientBuilder.standard()
        .withRegion(Regions.AP_SOUTH_1)
        .build();
  }

  @Bean
  public JavaMailSender javaMailSender(AmazonSimpleEmailService amazonSimpleEmailService) {
    return new SimpleEmailServiceJavaMailSender(amazonSimpleEmailService);
  }
}

电子邮件发件人服务类别：

import java.nio.charset.StandardCharsets;

import javax.mail.MessagingException;
import javax.mail.internet.MimeMessage;

import org.springframework.mail.javamail.JavaMailSender;
import org.springframework.mail.javamail.MimeMessageHelper;
import org.springframework.scheduling.annotation.Async;
import org.springframework.stereotype.Service;

import com.ebike.aws.emailutil.Mail;

@Service
public class AWSEmailSenderService {

    private JavaMailSender javaMailSender;

    public AWSEmailSenderService(JavaMailSender javaMailSender) {
        this.javaMailSender = javaMailSender;
    }

    @Async
    public void sendEmail(Mail mail) throws MessagingException {

        try {

            MimeMessage message = getMimeMessage(mail);
            javaMailSender.send(message);

        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private MimeMessage getMimeMessage(Mail mail) throws MessagingException {

        MimeMessage message = javaMailSender.createMimeMessage();

        MimeMessageHelper helper = new MimeMessageHelper(message, MimeMessageHelper.MULTIPART_MODE_MIXED_RELATED,
                StandardCharsets.UTF_8.name());

        String html = mail.getEmailBody();

        helper.setTo(mail.getTo());
        helper.setText(html, true);
        helper.setSubject(mail.getSubject());
        helper.setFrom(mail.getFrom());
        return message;
    }
}

Mail.java有一个方法来获取邮件对象

public Mail getMail() {
    Mail mail = new Mail();
    mail.setFrom(fromEmailID);
    mail.setTo(toEmailId);
    mail.setSubject(subject);
    mail.setEmailBody(emailBody);
    return mail;
}

在获得IAM用户未被授权执行“ses:SendRawEmail”异常后，我尝试添加策略以授予所有可能的权限，但我知道我必须在策略本身中进行修改，但在搜索了一段时间后，我无法理解，我已经浏览了此链接，但没有帮助或我无法理解。

目前IAM用户有以下AWS策略：

我不知道，下面是不是适用自定义政策的合适地方

请帮助我了解如何使用AWS SES为未经验证的电子邮件ID发送电子邮件，并为IAM用户授予所有可能的权限或策略。

Answer 1

此错误与IAM用户无关，而是与弹性豆茎的aws-elasticbeanstalk-ec2-role有关。

因此，您必须转到IAM角色，找到有问题的角色，并向其添加所需的权限。