I have an AWS lambda function that uses code like the following to send an email from [email protected].

import boto3

ses_client = boto3.client(
    "ses",
    region_name=AWS_REGION,
    aws_access_key_id=AWS_ACCESS_KEY,
    aws_secret_access_key=AWS_SECRET_KEY,
    endpoint_url=ENDPOINT,
)

response = ses_client.send_raw_email(
    Source='[email protected]',
    Destinations=recipients,
    RawMessage={
        'Data': msg.as_string(),
    }
)

As you can see in the code, it uses an aws_access_key_id and an aws_secret_access_key, which represent an IAM user, to send the email.

The IAM user represented by this aws_access_key_id has AmazonSESFullAccess permission. It can successfully send an email.

Today I add an IAM role which also has AmazonSESFullAccess permission to the lambda function. And remove the following 2 lines of code.

aws_access_key_id=AWS_ACCESS_KEY,
aws_secret_access_key=AWS_SECRET_KEY,

This makes ses_client use the IAM role to send emails.

But now, when I run the code, it throws an error saying Email address is not verified. The following identities failed the check in region <my_ses_region>: [email protected]

Does anyone know why?

I originally think when an IAM role and an IAM user have the same permission, they both should be able to do the same thing. But it seems that I was wrong.

Here’s my verified identity in SES:

How can I use the IAM role to send emails through SES?