How to report spam sent through Amazon SES.

Amazon's own email service. It's the one piece of AWS where the spam is unambiguously Amazon's to deal with.

The short version Look for amazonses.com in the headers. If it's there, report it through AWS's abuse form, one message per report, with the full headers included.

Step 1: Check that it really came through SES

Open the full headers. In Gmail it's the three dots next to Reply, then Show original. Here's how in other mail programs. Mail sent through Amazon SES carries lines like these. This is from a real one I got:

Feedback-ID: ::1.us-east-1.RKWWcKbF/jH52ji1QNb5y0RdAbT4H87O+BIOzvBuI8U=:AmazonSES

A Received line from smtp-out.amazonses.com. That's SES's mail server handing it to yours.
Feedback-ID ending in AmazonSES, and an X-SES-Outgoing header.
A DKIM signature from amazonses.com, usually next to one from the sender's own domain.

Not all Amazon spam is SES

Lots of spam comes from Amazon's network without being SES. The big one: Salesforce runs its mail servers on Amazon Web Services, so Salesforce mail comes from Amazon IP addresses too. If the headers show mta.salesforce.com and X-SFDC- lines, it's Salesforce's to deal with, and AWS will tell you so. Report Salesforce mail this way instead.

SES is different. The sender has an AWS account and is using Amazon's own email product directly. There's no middleman to point at.

Step 2: Report it to AWS

Use AWS's abuse form. You can also email email-abuse@amazon.com, but in my experience that address sends back an automatic reply with no case number, so there's nothing to follow up on. The form gets you a case number.
One message per report. AWS has asked me to split reports up and send each message separately.
Include the full headers, unedited, so they can match it to the sending account.
Say it's unsolicited and that you never signed up for anything from the sender.
Ask them to act on the sending account, not just to stop mail to you.

Step 3: Know what to expect

You'll get an automatic reply, then often a note that your report was forwarded to the SES team. After that you may hear nothing, or get a short notice that the issue was "mitigated" without saying what that means. Keep the case numbers. If the same sender comes back, report it again and cite them.

Across 77 AWS case numbers on all kinds of spam, AWS has never told me what it actually did to a sender. The closest it gets is "mitigated," with no detail. Here's how every company I report to stacks up.

Step 4: Go further

Spamhaus. Registered users can submit the message and the sender's domains through the Spamhaus submission portal. Blocklisting is what keeps the sender out of other people's inboxes.
The FTC. File at ReportFraud.ftc.gov and paste the email, headers included, into the comments.