且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

AWS:为SES不工作IAM用户策略

更新时间:2023-11-30 11:15:10

  

[...]也许修复程序我应该调整我的EC2服务器上的时间,但我怎么能发现什么时候是它的SES的服务器,因为我没有与他们接触?

而时钟偏差在杰里米·林德布洛姆的回答提到意味着时间您的服务器上没有充分与同步协调世界时(UTC)的减去时区偏移量,也就是你实际上并不需要知道时间对亚马逊SES 服务器(这肯定只是UTC虽然) ,而只是确保自己的系统与UTC太(不管你是在什么时区)同步 - 见我的回答同步本地的Debian时间与亚马逊Debian的实例(RDS)MDT为UTC 了解关于这个问题,以及如何详细解决这个让Debian / GNU RESP。 Ubuntu系统:

  

[...]这是很容易通过安装网络时间协议补救(NTP)守护进程自动设置的作为Debian的的日期时间,这可以归结为命令和apt-get安装NTP和编辑/etc/ntp.conf中目标更加的本地NTP服务器源,获取***的效果。

I'm trying to run the following PHP code on my server:

require 'aws_sdk_php/aws-autoloader.php';
use Aws\Ses\SesClient;

echo 'teste1';
$client = SesClient::factory(array(
    'key' => 'xxxxx',
    'secret' => 'yyyyy',
    'region' => 'us-east-1'
));
echo 'teste2';
echo $client->listIdentities();
echo 'teste3';
echo $client->verifyEmailIdentity(array(
    'EmailAddress' => 'my_email@gmail.com'
));

I created a user with permission to send emails using SMTP (ses:SendRawEmail) and it works just fine. However the "listIdentities" and "verifyEmailIdentity" calls only works when I grant SES Full Access permission or use full credentials for the account.

If I add only "ses:ListIdentities" and "ses:VerifyEmailIdentity" to the same user, I get a 403 error saying the signature not match. Anybody have any idea what's going on? Do I have to add other permissions/policies to grant access to this calls?

I also ran this permissions on the IAM Policy Simulator and they passed when they were set, but I received a "denied" after I removed them.

Thanks!


Update: According to this SES AWS Error Code: SignatureDoesNotMatch, Status Code: 403 MAYBE the fix is I should adjust the time on my EC2 server, but how can I found out what time is it on SES servers since I don't have access to them?


Update2: Doesn't seem like a case of diferent time, as I ran the code on a server on North Virginia and got the same results. Permissions passed on the simulator. Any suggestions?

[...] MAYBE the fix is I should adjust the time on my EC2 server, but how can I found out what time is it on SES servers since I don't have access to them?

The "clock skew" mentioned in Jeremy Lindblom's answer means that the time on your server isn't sufficiently synchronized with Coordinated Universal Time (UTC) after subtracting the timezone offset, i.e. you do not actually need to know the time on the Amazon SES servers (which most certainly is simply UTC though), rather just ensure that your own system is synchronized with UTC too (no matter what timezone you are in) - see my answer to synchronize local Debian time with amazon Debian instances (RDS) MDT to UTC for more details on the subject and how to resolve this for a Debian/GNU resp. Ubuntu system:

[...] This is easily remedied by installing a Network Time Protocol (NTP) daemon to Set the time automatically as explained in Debian's DateTime, which boils down to sudo apt-get install ntp and editing /etc/ntp.conf to target more local NTP server sources for optimal results.