if you run on an ec2-instance and the instance is associated with an appropriate IAM Role, you probably don't have to specify -access-key-id & -secret-access-key
AWS Policy
the credential provided manually or fetched automatically by IAM Role should have the policy that includes actions, 'ses:GetSendQuota' and 'ses:GetSendStatistics'