Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
ses_identity_not_publicly_accessibleProvider: AWS
Service:
sesSeverity: HIGH
Categories:
internet-exposedResource type:
AwsIamPolicyWhat this check verifies
Amazon SES identities are evaluated for publicly accessible resource policies-for example, statements withPrincipal:"*" or broadly trusted principals that permit actions against the identity.
Risk
Public SES identity policies allow unauthorized email sending or configuration changes.- Integrity: spoofed emails and brand impersonation
- Confidentiality: exposure of identity details
- Availability: reputation loss causing throttling or suspension
Recommendation
Restrict SES identity policies to known principals and actions following least privilege. Prefer explicit account ARNs for sending authorization, and add conditions likeaws:SourceIp and aws:SecureTransport. Review grants regularly and remove unused access as part of defense in depth.
Remediation
- CLI
- Terraform
- Dashboard steps
aws sesv2 delete-email-identity-policy —email-identity <IDENTITY-NAME> —policy-name <POLICY-NAME>
References
- https://docs.aws.amazon.com/ses/latest/dg/policy-anatomy.html
- https://docs.aws.amazon.com/ses/latest/dg/identity-authorization-policies.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = ses_identity_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks