How should I write IAM to make only a certain VPC can send mail via SES?

Question

I use Redash on EC2 instance, and I have to send invitation mails via Amazon SES.
I'd like to add a setting to restrict mail sender to inside a certain VPC where the Redash instance is located.

Here's my IAM for SES:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ses:SendRawEmail",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpce": "vpce-******"
                },
                "ForAnyValue:StringLike": {
                    "ses:Recipients": "*@mycompany.com"
                }
            }
        }
    ]
}

But I can't send any mail. I think it's because I use VPC endpoint in the code above. It's not available for SES yet.
Is there any other way to specify a certain VPC?

Answer 1

This is an interesting challenge!

The Amazon SES interface is on the internet, so theoretically anything can access it. Normally, policy restrictions use permissions on the IAM User or Role that calls SES to determine whether calls are allowed, rather than from where the call is made.

I assume you are doing this because you only want your Production system to send emails, rather than Dev/Test systems.

However, it is not possible to restrict via VPC, because Amazon SES has no visibility to the concept of a VPC. It simply receives API calls via the Internet.

If your application is in a private subnet and sends requests via NAT Gateway, then you could add a policy to restrict based upon the IP address of the NAT Gateway.

You could do this either by putting the restriction on the Allow statement, or by adding a Deny statement.

See: AWS: Denies Access to AWS Based on the Source IP - AWS Identity and Access Management