A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated…

The application's primary constraint is its reliance on the SMTP protocol. To integrate with Amazon SES via SMTP, a secure, authenticated connection is mandatory. Amazon SES supports two encryption methods for its SMTP endpoint: STARTTLS and TLS Wrapper. Authentication is handled via SMTP credentials (a username and password) derived from an IAM user's access keys.

Option B correctly identifies a valid encryption mechanism (STARTTLS) and the correct authentication method (Amazon SES SMTP credentials). Although the legacy application does not natively support STARTTLS, the requirement to "modify the application" implies implementing a solution, such as a local SMTP relay, that can establish the required encrypted and authenticated connection to the SES endpoint on behalf of the application.

A. This option proposes using an IAM role for authentication. IAM roles attached to EC2 instances grant permissions for API calls, not for authenticating with the SES SMTP interface, which requires SMTP credentials.

C. This option suggests using the SES API, which violates the explicit requirement that the application can only use the SMTP protocol.

D. This option suggests using AWS SDKs. This is a form of API interaction and violates the constraint that the application is limited to using only the SMTP protocol.

---

1. Amazon SES Developer Guide - Connecting to an Amazon SES SMTP endpoint: This document specifies the connection requirements. It states

"To connect to the Amazon SES SMTP endpoint

your client application must support Transport Layer Security (TLS). We recommend that you use STARTTLS or TLS Wrapper." This supports the encryption part of option B.

Source: AWS Documentation

Amazon Simple Email Service Developer Guide

"Connecting to an Amazon SES SMTP endpoint".

2. Amazon SES Developer Guide - Obtaining Amazon SES SMTP credentials: This guide details the authentication process for the SMTP interface. It explains

"To authenticate with Amazon SES

you have to provide your SMTP credentials... You can't use your AWS access keys directly to authenticate with the SMTP server. You have to use a procedure to convert your AWS secret access key into an SMTP password." This confirms that SMTP credentials

not IAM roles directly

are required

making option B correct and A incorrect.

Source: AWS Documentation

Amazon Simple Email Service Developer Guide

"Obtaining Amazon SES SMTP credentials".

3. Amazon SES Developer Guide - Integrating Amazon SES with your existing email server: This document provides a solution for the exact scenario in the question

where a legacy application needs to connect to SES. It describes configuring an SMTP relay (like Postfix) which connects to the SES SMTP endpoint using TLS and authenticates with SMTP credentials. This validates the overall approach implied by option B.

Source: AWS Documentation

Amazon Simple Email Service Developer Guide

"Integrating Amazon SES with your existing email server".