AWS SES通过VPC端点无法发送邮件问题求助

问题背景 #

• EC2实例部署在私有子网，无互联网连接，已配置VPC Endpoint
• VPC端点安全组配置：允许EC2私有IP访问587端口
• 执行命令 telnet email-smtp.eu-central-1.amazonaws.com 587 可成功建立连接，返回 Connected to email-smtp.eu-central-1.amazonaws.com.
• 使用AWS SES Kotlin SDK调用sendEmail时触发超时异常：

  amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Connect to email.eu-central-1.amazonaws.com:443 [email.eu-central-1.amazonaws.com/<SOME_IP>, email.eu-central-1.amazonaws.com/<SOME_IP>,email.eu-central-1.amazonaws.com/<SOME_IP>, email.eu-central-1.amazonaws.com/<SOME_IP>, email.eu-central-1.amazonaws.com/<SOME_IP>, email.eu-central-1.amazonaws.com/<SOME_IP>] failed: Connect timed out

核心原因分析 #

1. VPC端点类型不匹配
   你配置的是SES SMTP协议的VPC端点（对应端口587），但代码中使用的是SES REST API（请求地址为email.eu-central-1.amazonaws.com:443），二者是完全独立的服务端点：

   • SES SMTP端点：email-smtp.<region>.amazonaws.com，端口587/465，供传统SMTP客户端使用
   • SES API端点：email.<region>.amazonaws.com，端口443，供AWS SDK调用sendEmail等API接口

2. 安全组端口配置不匹配
   现有VPC端点安全组仅开放587端口，但SES API需要访问443端口，即使配置了正确的SES API VPC端点，安全组也需同步开放对应端口。

解决方案 #

方案一：改用SES SMTP协议发信（适配现有VPC端点） #

无需新增VPC端点，修改代码通过SMTP协议发送邮件：

import javax.mail.*
import javax.mail.internet.InternetAddress
import javax.mail.internet.MimeMessage
import java.util.Properties

fun sendEmailViaSmtp() {
    val smtpHost = "email-smtp.eu-central-1.amazonaws.com"
    val smtpPort = 587
    val username = sesAccessKey
    val password = sesSecretKey
    val fromEmail = "email@domain.pl"
    val toEmail = email
    val url = "url"

    val props = Properties()
    props["mail.smtp.auth"] = "true"
    props["mail.smtp.starttls.enable"] = "true"
    props["mail.smtp.host"] = smtpHost
    props["mail.smtp.port"] = smtpPort

    val session = Session.getInstance(props, object : Authenticator() {
        override fun getPasswordAuthentication(): PasswordAuthentication {
            return PasswordAuthentication(username, password)
        }
    })

    try {
        val message = MimeMessage(session)
        message.setFrom(InternetAddress(fromEmail))
        message.addRecipient(Message.RecipientType.TO, InternetAddress(toEmail))
        message.subject = "Subject"
        message.setText("Email content with url: $url")

        Transport.send(message)
    } catch (e: MessagingException) {
        e.printStackTrace()
    }
}

方案二：新增SES API类型VPC端点（保留现有SDK代码） #

1. 在AWS控制台创建SES API类型的VPC端点，服务名称为com.amazonaws.eu-central-1.email
2. 配置该VPC端点的安全组：允许EC2实例私有IP访问443端口
3. 确保VPC路由表中添加该端点的路由规则，指向SES API的前缀列表

验证步骤 #

• 执行 telnet email.eu-central-1.amazonaws.com 443，若超时则说明VPC端点、路由或安全组配置存在问题
• 检查EC2实例安全组：是否允许出站访问443端口到VPC端点的IP范围

内容的提问来源于stack exchange，提问作者asfarasiknow