Amazon SES 535 Authentication Credentials Invalid trying to rotate access key

We have an Amazon SES setup that works well and sends thousands of emails a day via SMTP. Trying to follow a best practice of "rotating" access keys we went to https://console.aws.amazon.com/iam/home and creating a new access key for the exact same user which is used to send emails. The new key is supposedly active but when trying to email with the access keys, we keep getting

535 Authentication Credentials Invalid

Switching to the old access keys works well and emails are sent. Tried a couple of times to delete the new access keys and create others. Same machine, same software. We have proper copy+paste skills to ensure we're using the same ID/Password provided in the CSV coming from Amazon. Here the dialog from Amazon:

So what's going on? Is there a time limit till the new key becomes active? Is there some other hidden limitation somewhere?

You are confusing the SMTP credentials with access_key and secret. They are different.

• access_key/secret --> Use in SDK and CLI

• SMTP credentials --> Use to configure SES SMTP

• You are creating a new access_key/secret and using it as SMTP credentials

• Instead you create a new SMTP credentials and use it
• Key rotation is different from SMTP credential rotation
• No need to create a new user

It is likely you are using the SMTP credentials that does not change even if you generate another set of access_key/secret. In your case it looks like you are using the SMTP server and not the SDK. So generating a new set of access_key/secret has no effect on SMTP credentials.

If you want to create a new set of SMTP credentials, go to AWS SES dashboard and create SMTP credentials.

For more information: Obtaining Your Amazon SES SMTP Credentials