THE RISK YOU CAN'T AFFORD TO IGNORE: AWS SES AND EMAIL SPOOFING

Summary from the TLDR InfoSec newsletter

AWS SES allows sending emails using an individually verified email or any email in a verified domain. If an attacker has the requisite IAM privileges, they can spoof any email address in a verified domain for phishing attacks and there is no ability to log emails sent. Use verified emails or the "ses:FromAddress" condition in SES IAM policies to prevent this attack.