Upgrade to signature v4 necessary

[rickpastoor]

Here's the email I got about an impending deprecation:

Hello,

Amazon Web Services currently supports Amazon SES API requests that are signed using Signature Version 3 and Signature Version 4 processes. Signature Version 4 further enhances the security around authentication and authorization of Amazon SES customers by using a signing key instead of your secret access key. To improve the security for our customers, beginning October 1, 2020, Amazon Signature Version 3 will be turned off (deprecated) in Amazon SES in favor of Signature Version 4.

Amazon SES customers who are still using Signature Version 3 must migrate to Signature Version 4 by September 30, 2020. After that, Amazon SES will only accept requests that are signed using Signature Version 4. For more information, see Signature Version 4 signing process [1].

Is anywone working on updating this gem to support V4? Or should I look for a different gem?

[lvangool]

I am also wondering about this... in the case of the answer being "NO", are there any other recommended gems for a simple SES Sigv4 use-case? I'm trying to avoid going native with the AWS SDKv3!

[tirtawr]

Same here! Still looking for alternative gems

[teddyswu]

I am also wondering too. And hope to have an answer! thank

[coryetzkorn]

+1 please share if you find an alternative

[abisosa]

We just replaced this gem with smtp and aws ses credentials config: https://hixonrails.com/ruby-on-rails-tutorials/ruby-on-rails-action-mailer-configuration/#amazon-ses-account-setup

[whitmer]

Anyone tried this https://github.com/tablecheck/mail-ses ? I'm going to play with it but it may take me a couple weeks to get to it..

[TinNT]

FYI, This fork https://github.com/ofri-switzerland/aws-ses/pull/1 worked perfectly

[Pyo25]

Otherwise there is the official AWS Rails plugin.

[ncri]

Can this be closed as https://github.com/ofri-switzerland/aws-ses/pull/1 has been merged?

[ncri]

Ah, sorry, my mistake, has only been merged in their fork. I will try that out.

[drewblas]

Ideally I'd like to merge in @ofri-switzerland 's fork, however it looks like they hardcoded the us-east-1 REGION into the request. I believe to really make it work correctly for everyone the us-east-1 could be the default but should also be overridable through a config param

If anyone knows of a fixed version that accomplishes this, I'm happy to merge it and cut a new version!

[rwojsznis]

Hi @drewblas; fair point! - we probably can make that configurable and prep pull request for review if you're interested in releasing new version of your gem :) /cc @m33h (let's discuss this tomorrow maybe)

edit: we will get back to this very next week, pinky promise!

[lucascaton]

I've replaced this gem with the official aws-sdk-rails gem from AWS.

Here's a quick step-by-step:

1. Replace the gem in the Gemfile:

-gem "aws-ses", require: "aws/ses"
+gem "aws-sdk-rails" # This gem is used to send emails via SES

2. [Optional] Move/add/update your credentials:

$ rails credentials:edit

aws:
  ses:
    access_key_id: "..."
    secret_access_key: "..."

3. Create/update a initializer (eg.: config/initializers/aws_ses.rb):

if Rails.env.production?
  Aws::Rails.add_action_mailer_delivery_method(
    :ses,
    credentials: Aws::Credentials.new(
      Rails.application.credentials.aws[:ses][:access_key_id],
      Rails.application.credentials.aws[:ses][:secret_access_key]
    ),
    region: "us-east-1"
  )
end

4. Make sure your config/environments/production.rb has the following config:

config.action_mailer.delivery_method = :ses

---

That's it. I've just deployed my application and it's working perfectly 👍

[rickpastoor]

Just upgraded the gem to the latest version and seems to work perfectly 👍 Thanks @m33h!

[sunilsoma]

@lucascaton Do you know how to confirm in rails if ses version is upgraded, how to confirm this in ec2 or rails that now ses version is upgraded? after changing this gem

[TomohiroKai]

@sunilsoma In my own way, I checked returned value of mail method like below. mail(subject: subject, to: to).to_json There is this value. delivery_method>client>config>api>metadata>signatureVersion I think If signatureVersion is "v4", then it's fine.

This json is very long. So be careful to handle it (some editor may freeze. I used sublime text and it could handle).