状态码 403：我使用 Amazon SES 时的 SignatureDoesNotMatch

Question

I created a new Amazon account. Created SMTP Credentials and used AWS Java SDK to send emails. But it is failing with following error:

Status Code: 403, AWS Service: AmazonSimpleEmailService, AWS Request ID: xyz, AWS Error Code: SignatureDoesNotMatch, AWS Error Message: The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

Answer 1

The keys to be provided to send Emails are not "SMTP Credentials" . The keys are instead Global access key which can be retrieved http://docs.amazonwebservices.com/ses/latest/GettingStartedGuide/GetAccessIDs.html .

Answer 2

SMTP Credentials are not valid for use with SES API (AWS Java SDK). SMTP credential are in fact different to the ones manually created for IAM users, even that this different is not visible anywhere on AWS Console. Take a look here to see differences: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-credentials.html

You don't actually need to create Global Access credentials (which could be a security leak), but you should create a new IAM user with the following security policy, and create new credentials for that user.

{
"Version": "2012-10-17",
"Statement":[{
   "Effect":"Allow",
   "Action":["ses:SendEmail", "ses:SendRawEmail"],
   "Resource":"*"
   }
]
}

PS: Probably, you could just add new credentials to the SMTP IAM user already created for SES, but I haven't yet tested this.

Answer 3

Link to latest doc for credential types - https://docs.aws.amazon.com/ses/latest/dg/send-email-concepts-credentials.html