Profile Applicability:
- Level 1
Description:
Amazon Simple Email Service (SES) is a fully managed email sending service that allows you to send and receive emails using your own domains. SES identities, such as email addresses or domain names, need to be verified before they can be used to send or receive emails. Publicly accessible SES identities are those that can be viewed or accessed by unauthorized parties, which may result in misuse or security vulnerabilities.
Ensuring that SES identities (whether email addresses or domain names) are not publicly accessible ensures that only authorized users can interact with them, thus preventing unauthorized email usage or impersonation attacks.
Rationale:
Security: Exposing SES identities publicly could allow attackers to spoof emails or abuse your domain, leading to email spoofing, phishing, or spam.
Access Control: By restricting access to SES identities, you ensure that only authorized services and users have permission to send emails, enhancing security.
Compliance: Certain regulatory frameworks (e.g., SOC 2, PCI-DSS, HIPAA) require ensuring that sensitive email identities are not exposed to unauthorized parties.
Prevention of Abuse: Publicly accessible SES identities increase the risk of your domain being added to email blacklists, which can impact the delivery of legitimate emails.
Impact:
Pros:
Enhanced Security: Protects your SES identities from unauthorized access and misuse.
Prevents Email Spoofing: Reduces the risk of attackers impersonating your domain and sending phishing emails.
Maintains Email Reputation: By securing SES identities, you ensure that your domain remains trusted by email providers and does not end up on blacklists.
Compliance: Meets regulatory and industry standards for controlling sensitive data and resources.
Cons:
Operational Complexity: Restricting access to SES identities might require configuring IAM policies and ensuring proper access control.
Administrative Overhead: Additional management may be required to ensure identities remain protected and not publicly exposed.
Default Value:
By default, SES identities (such as email addresses or domains) are private and cannot be accessed by the public. However, issues may arise if IAM policies, domain records, or other configurations inadvertently expose SES identities publicly.
Pre-requisite:
AWS IAM Permissions:
ses:ListIdentities
ses:GetIdentityVerificationAttributes
ses:SetIdentityNotificationTopic
ses:DeleteIdentity
AWS CLI installed and configured.
SES Identities (email addresses or domains) must be verified within the SES service.
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to Amazon SES under Services.
In the SES Dashboard, go to Identity Management > Identities.
Review the list of verified email addresses and domains.
Ensure that IAM policies or domain configurations do not inadvertently expose SES identities to the public.
Review any associated SNS topics or notifications and ensure that only authorized users and services can modify or view SES identity configurations.
If a public identity is found, modify the settings to restrict access.
Using AWS CLI:
To check the list of SES identities, run:
aws ses list-identities --identity-type EmailAddress --query 'Identities'
To check the verification status of each identity, run:
aws ses get-identity-verification-attributes --identities <identity>
To ensure that no public identities exist, verify that the identity verification status is correct and there are no unauthorized access configurations.
If a public identity is found, revoke access by removing any policies or notifications that allow public access.
Implementation Steps:
Using AWS Console:
Log in to the AWS Management Console and navigate to Amazon SES.
In the SES Dashboard, go to Identity Management > Identities.
Review each identity and verify that only authorized accounts or services have access to modify or use the identity.
Update IAM policies and domain records to restrict public access to SES identities.
For email identities, ensure that they are not shared publicly or exposed via unsecured DNS configurations.
Ensure that SNS topics or other notification mechanisms are secured and do not allow unauthorized modifications to SES identities.
Save any changes to ensure that SES identities are protected.
Using AWS CLI:
To check the list of SES identities, run:
aws ses list-identities --identity-type EmailAddress --query 'Identities'
To remove a public identity or prevent it from being used by unauthorized parties, revoke permissions or remove it from public access:
aws ses delete-identity --identity <identity>
Ensure that only the authorized services or users can access and modify SES identities.
Backout Plan:
Using AWS Console:
If restricting access to SES identities causes issues, sign in to the AWS Management Console.
Navigate to Amazon SES, select the SES identity, and modify its access permissions.
Remove any restrictive policies or settings that may have unintentionally caused legitimate email operations to fail.
Using AWS CLI:
If access restrictions to an SES identity cause issues, run the following command to delete the restrictive policy:
aws ses delete-identity-policy --identity <IDENTITY> --policy-name <POLICY_NAME>
Revert the SES identity policy to allow broader access if necessary, or adjust the policy to resolve issues:
aws ses set-identity-policies --identity <IDENTITY> --policy-name <POLICY_NAME> --policy-document <POLICY_DOCUMENT_JSON>