Detects enumeration of Amazon Simple Email Service (SES) resources by using long-term IAM access keys (AKIA* prefix). Long-term keys are vulnerable to exposure in source code, config files, or CI/CD pipelines and do not expire, making them a common target for attackers. If an adversary obtains such a key, they may query SES via CloudTrail to discover verified identities (email addresses and domains), sending quotas, and DKIM/MAIL FROM configurations, which can facilitate phishing or spam campaigns from a compromised account. The rule monitors CloudTrail data for SES management API calls performed with a long-term key (AKIA*), including ListIdentities, GetAccountSendingEnabled, GetSendQuota, ListEmailIdentities, GetEmailIdentity, DescribeActiveReceiptRuleSet, and ListReceiptRuleSets. A successful outcome combined with an AKIA-keyed user identity triggers alerts. This is categorized under Cloud/SES activity and aligns with MITRE ATT&CK Discovery (T1526) via the cloud service discovery technique. The rule is intended to surface potential misuse of credentials and guide immediate containment actions, credential rotation, and a shift to short-lived credentials via IAM roles. Triage guidance, investigation steps, and remediation are included in the rule to help correlate the key holder, verify whether the key has rotated, assess potential impact on SES quotas and sending history, and locate any exposure of the key in code repositories or CI/CD pipelines. The rule emphasizes that automated infrastructure inventory tooling using long-term keys can generate false positives and should migrate to role-based access with temporary credentials. The detection is designed to operate on SES-related CloudTrail events within the last 6 minutes of ingestion.