amazon cloudwatch - Identify what SES calls are using version 2 signature logins

Question

Like many I'm sure, we've received an email from Amazon stating: We recently observed Signature Version 2 requests on an Amazon SES SMTP endpoint originating from your account.

Is there any way to identify what these calls are as we have several IAM users and large codebases and haven't yet been able to trace the origin of these calls.

I'm thinking this should be possible with CloudWatch/CloudTrail but can't see how to do this.

question from:https://stackoverflow.com/questions/65849302/identify-what-ses-calls-are-using-version-2-signature-logins

Answer 1

From a question in the AWS dev forum

If your existing smtp credentials were created via console, the creation date (visible in IAM console) can be an indication of Signature v2 usage, as smtp users created via the SES console before Feb 2019 were Signature v2 signed. Credentials created in the SES console after this date are signed using Signature v4.