Why do I get a "535 Authentication credentials invalid" error from an Amazon SES SMTP endpoint?

Short description

When you use Amazon SES to send emails, you must provide the correct security credentials to communicate with the API or an SMTP endpoint.

Resolution

To troubleshoot the "535 Authentication credentials invalid" error, complete the following tasks:

• Use the correct credentials: Use the SMTP credentials that are generated from the Amazon SES console instead of the credentials that the AWS Identity and Access Management (IAM) console generates. For more information, see How can I create SMTP credentials to use with Amazon SES? How can I authenticate to Amazon SES using SMTP credentials?
• Check your AWS Region: Connect to the same Region that you generated the SMTP credentials in. The credentials that are required to use an SES SMTP endpoint are unique for each Region. You must generate a separate set of SMTP credentials for each Region that you use.
• Rotate your SMTP credentials: If you get an “535 Authentication credentials invalid" error after you rotate your current SMTP credentials, then you might have incorrectly rotated your credentials. For more information, see How can I rotate my access keys for an existing Amazon SES SMTP IAM user?
• Review your credentials for mistakes: Make sure that there are no mistakes in your credentials. Your username and password credentials can't contain any typos or additional spaces.
• Review the encoding of your credentials: When you use the Amazon SES SMTP interface to send emails, make sure that your SMTP credentials are in Base64-encoded format. Most SMTP applications perform the Base64 encoding by default. If don't know your application's default behavior, then it's a best practice to manually encode the credentials in Base64.