SES Send Email fails with permission denied

[Mint_IT_Media]

I’m facing the same issue as the one posted here:

SES Send Email fails with permission denied (only on Netlify, works on other site with same credentials & code)

Hey there, both projects are nearly the same code base (Gatsby + Netlify) and both have a similar function to send emails using SES. Same AWS credentials even. And the code to send emails via SES is the same. However, on one site everything works as expected, on the other site the Netlify functions return: AccessDenied: User `arn:aws:sts::XXXXXXXXX:assumed-role/aws-lambda-execute/YYYYY' is not authorized to perform `ses:SendEmail' on resource `arn:aws:ses:eu-west-1:XXXXXXX:identity/EMAIL@TLD.…

Lambda function:
https://calendar.luptico.com/.netlify/functions/send-email

code can be found here:
https://github.com/garciadiazjaime/website-calendar/blob/main/netlify/functions/send-email.js

error

{
status: "NOT_SEND",
message: "AccessDenied: User `arn:aws:iam::117428681856:user/valle' is not authorized to perform `ses:SendEmail' on resource `arn:aws:ses:us-east-1:117428681856:identity/*****@****.com'",
}

is there a way to add ses:SendEmail permission to the lambda function?

Thanks.

[hrishikesh]

Hey @Mint_IT_Media,

Since Netlify Functions run on AWS in Netlify’s AWS accounts, I don’t think this is supposed to work. I haven’t checked the AWS docs, but unless they provide a way to specify which account to use SES from, this would not work.

If AWS doesn’t provide a way to do that, on the Enterprise plan, we allow users to deploy Netlify Functions to their own AWS account where you can manage this setting yourself.

[Mint_IT_Media]

got it, thanks for answering!