AWS ses documentation change
Summary
Clarified documentation regarding SMTP vs. API VPC endpoints, added port 443 guidance for API endpoints, and FIPS endpoint references
Security assessment
The changes emphasize using port 443 (HTTPS) for API endpoints and mention FIPS-compliant endpoints, which are security best practices. However, there is no evidence this addresses an active security vulnerability - rather, it improves documentation of existing security features.
Diff
diff --git a/ses/latest/dg/send-email-set-up-vpc-endpoints.md b/ses/latest/dg/send-email-set-up-vpc-endpoints.md index 32d5fe12c..f99d3ecce 100644 --- a//ses/latest/dg/send-email-set-up-vpc-endpoints.md +++ b//ses/latest/dg/send-email-set-up-vpc-endpoints.md @@ -19 +19 @@ When using a VPC Endpoint, traffic to SES does not transmit over the internet an - * SES does not support VPC endpoints in the following Availability Zones: `use1-az2`, `use1-az3`, `use1-az5`, `usw1-az2`, `usw2-az4`, `apne2-az4`, `cac1-az3`, and `cac1-az4`. + * SES does not support SMTP VPC endpoints in the following Availability Zones: `use1-az2`, `use1-az3`, `use1-az5`, `usw1-az2`, `usw2-az4`, `apne2-az4`, `cac1-az3`, and `cac1-az4`. @@ -40 +40 @@ Before you complete the procedure in this section, you have to complete the foll -While VPC endpoints for SES can be used with any resource, for ease of test method, this example will have you use an EC2 instance as the resource. Because Amazon EC2 restricts email traffic over port 25 by default, you'll have to use a different port other than TCP 25, such as TCP 465, 587, 2465, or 2587—for more information, see [Restriction on email sent using port 25](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html#port-25-throttle). +While VPC endpoints for SES can be used with any resource, for ease of test method, this example will have you use an EC2 instance as the resource. Because Amazon EC2 restricts email traffic over port 25 by default, for SMTP endpoints you'll have to use a different port other than TCP 25, such as TCP 465, 587, 2465, or 2587—for more information, see [Restriction on email sent using port 25](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html#port-25-throttle). For API endpoints use port 443. @@ -47 +47 @@ While VPC endpoints for SES can be used with any resource, for ease of test meth -The process of setting up a VPC endpoint to use with SES consists of a few separate steps. First, you have to create a security group that allows the instance to communicate with SMTP ports, then create a VPC endpoint for Amazon SES, and finally, test the connection to the VPC endpoint to ensure that it's configured properly. +The process of setting up a VPC endpoint to use with SES consists of a few separate steps. First, you have to create a security group that allows the instance to communicate with the chosen port(s), then create a VPC endpoint for Amazon SES, and finally, test the connection to the VPC endpoint to ensure that it's configured properly. @@ -73 +73 @@ In this step, you create a security group that lets Amazon EC2 instances communi - * For **Port range** , enter the port number that you want to use to send email. You can use any of the following port numbers: `465`, `587`, `2465`, or `2587`. + * For **Port range** , enter the port number that you want to use to send email. For SMTP endpoints, you can use any of the following port numbers: `465`, `587`, `2465`, or `2587`. For API endpoints, use port 443. @@ -102 +102 @@ In Amazon VPC, a _VPC endpoint_ lets you connect your VPC to supported AWS servi - 6. In the **Services** panel, filter on _smtp_ in the search bar, then select its radio button. + 6. In the **Services** panel, for SMTP endpoints, filter on _smtp_ in the search bar, then select its radio button. For API endpoints, filter on _email_ in the search bar. You can also use a FIPS endpoint by searching for _email-fips_. @@ -110 +110 @@ In Amazon VPC, a _VPC endpoint_ lets you connect your VPC to supported AWS servi -Amazon SES doesn't support VPC endpoints in the following _Availability Zones_ : `use1-az2`, `use1-az3`, `use1-az5`, `usw1-az2`, `usw2-az4`, `apne2-az4`, `cac1-az3`, and `cac1-az4`. +Amazon SES doesn't support SMTP VPC endpoints in the following _Availability Zones_ : `use1-az2`, `use1-az3`, `use1-az5`, `usw1-az2`, `usw2-az4`, `apne2-az4`, `cac1-az3`, and `cac1-az4`. @@ -133 +133 @@ For information about connecting to Windows instances, see the [Get started tuto - 2. Send a test email, for example, by using the SES SMTP interface. + 2. Send a test email. For the SMTP endpoint, use the SES SMTP interface. For the API endpoint, use the SES CLI or API.