SES Permissions Broken

[thebeanogamer]

[ERROR] ClientError: An error occurred (AccessDenied) when calling the SendEmail operation: User `arn:aws:sts::943532947865:assumed-role/linkshortener-prod-eu-west-2-lambdaRole/linkshortener-prod-email' is not authorized to perform `ses:SendEmail' on resource `arn:aws:ses:eu-west-1:<redacted>:identity/<redacted>'
Traceback (most recent call last):
  File "/var/task/serverless_sdk/__init__.py", line 130, in wrapped_handler
    return user_handler(event, context)
  File "linkshortener/notifications.py", line 49, in summary
    client.send_email(
  File "/var/task/botocore/client.py", line 316, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/task/serverless_sdk/vendor/wrapt/wrappers.py", line 602, in __call__
    return self._self_wrapper(self.__wrapped__, self._self_instance,
  File "/var/task/serverless_sdk/__init__.py", line 447, in wrapper
    raise error
  File "/var/task/serverless_sdk/__init__.py", line 440, in wrapper
    response = wrapped(*args, **kwargs)
  File "/var/task/botocore/client.py", line 626, in _make_api_call
    raise error_class(parsed_response, operation_name)

[thebeanogamer]

IAM for SES requires you to specify both of these ARNs to send an email:

• arn:aws:ses:{SES_REGION}:{AWSACCOUNTID}:identity/{DOMAIN}
• arn:aws:ses:{SES_REGION}:{AWSACCOUNTID}:identity/{DESTINATIONADDRESS}