Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We want to setup our corporate SMTP server to use AWS SMTP, which uses credentials separate from the AWS Access key and secret. I am thinking that Amazon keeps these separate so that if someone is sending spam through our SMTP server, Amazon can shut down that account while not affecting our website/app that sends email through the SES API using the Access Key and Secret. Our IT admin proposes that if (somehow) someone sends a bunch of spam through our SMTP account (using AWS STMP credentials), Amazon would may shutdown both our SMTP credentials and our access key+secret leaving all our sites without the ability to send email through the API because someone abused the SMTP access.

share|improve this question
    
If you send spam via either method your SES will probably wind up rate limited regardless of which method was used. –  ceejayoz May 6 at 17:38
    
They obviously know that the different credentials belong to the same customer. If they find that a customer is abusing their service it does not seem inconceivable that they will block the customer altogether. aws.amazon.com/aup and aws.amazon.com/agreement seem relevant. –  Håkan Lindqvist May 6 at 17:40
    
At the same time though, I would think that the reason they have segregation is specifically because they expect one set of credentials might be abused or there might simply be a bug in the system/app related to a IAM credentials. I perceive that this is why they include in their documentation as an example, that you might have a "Developer" group. A junior dev with a bug in the code should not be able to take your corporate SES SMPT service, right? I can't find anything definitive though. –  M.Mugge May 6 at 17:48
1  
A junior dev should probably be using dev credentials on another AWS account. You might be able to get a one-off support remediation of your spam rep, but Amazon has to protect the other users of SES. –  ceejayoz May 6 at 17:53
    
@M.Mugge If they just block specific credentials it will be more difficult for them to deal with those that really are there to spam. As for the required separation it could also be seen as "for your own protection" in a different regard, not that it's ok if your SES credentials are compromised and abused but rather that whoever got access to those can only send mail; not shut down all your other services, run a huge bitcoin farm on EC2 or whatnot. –  Håkan Lindqvist May 6 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.