title: How can I restrict my AWS SES verified domain to only a specific VPC IP range?
body: <p>I have a verified domain that works with the IAM user I have created.</p>
  <p>Emails go out successfully.</p>
  <p>I am looking to lock this down, so I have first created a VPC endpoint, that allows SMTP traffic from the entire VPC. This too works without issue.</p>
  <p>Finally, I want to <strong>only</strong> allow email to be sent via <strong>this endpoint</strong>, and as such want to have the SES Authorization policy to accept email sending from the local VPC range (10.204.0.0/16 for example). This is to ameliorate for any leaked credentials so bad actors cannot send emails impersonating our domain just because they have some SES access.</p>
  <p>I cannot filter by <code>aws:SourceIp</code> as this only works for public IP addresses.</p>
  <p>As such, is this even possible or do I have to allow for the possibility (however unlikely that is) that leaked credentials could allow external actors to send as our verified domain?</p>