diff --git a/API.md b/API.md
index 5519d7d2..daa426f2 100644
--- a/API.md
+++ b/API.md
@@ -155,6 +155,7 @@ const sesSmtpCredentialsProps: SesSmtpCredentialsProps = { ... }
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
 | <code><a href="#@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.passwordSecretKey">passwordSecretKey</a></code> | <code>string</code> | Optional, the key name to use in the secret to write the password to (defaults to Credentials.PASSWORD). |
+| <code><a href="#@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.region">region</a></code> | <code>string</code> | The region of SES endpoint to use. |
 | <code><a href="#@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.secret">secret</a></code> | <code>aws-cdk-lib.aws_secretsmanager.ISecret</code> | Optional, an SecretsManager secret to write the AWS SES Smtp credentials to. |
 | <code><a href="#@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.user">user</a></code> | <code>aws-cdk-lib.aws_iam.IUser</code> | The user for which to create an AWS Access Key and to generate the smtp password. |
 | <code><a href="#@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.userName">userName</a></code> | <code>string</code> | Optional, a username to create a new user if no existing user is given. |
@@ -174,6 +175,20 @@ Optional, the key name to use in the secret to write the password to (defaults t
 
 ---
 
+##### `region`<sup>Optional</sup> <a name="region" id="@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.region"></a>
+
+```typescript
+public readonly region: string;
+```
+
+- *Type:* string
+
+The region of SES endpoint to use.
+
+Defaults to stack region.
+
+---
+
 ##### `secret`<sup>Optional</sup> <a name="secret" id="@pepperize/cdk-ses-smtp-credentials.SesSmtpCredentialsProps.property.secret"></a>
 
 ```typescript
diff --git a/src/provider/credentials-handler.lambda.ts b/src/provider/credentials-handler.lambda.ts
index 9b7a47f9..47e8b712 100644
--- a/src/provider/credentials-handler.lambda.ts
+++ b/src/provider/credentials-handler.lambda.ts
@@ -18,7 +18,7 @@ export async function handler(event: OnEventRequest): Promise<OnEventResponse |
     const secretId = event.ResourceProperties.SecretId;
     const userNameSecretKey = event.ResourceProperties.UserNameSecretKey;
     const passwordSecretKey = event.ResourceProperties.PasswordSecretKey;
-    const region = process.env.AWS_DEFAULT_REGION as string;
+    const region = process.env.SES_REGION as string;
     const iam = new AWS.IAM();
     const secretsManager = new AWS.SecretsManager();
 
diff --git a/src/provider/credentials-provider.ts b/src/provider/credentials-provider.ts
index edec99bd..201156f9 100644
--- a/src/provider/credentials-provider.ts
+++ b/src/provider/credentials-provider.ts
@@ -6,17 +6,27 @@ import { Provider } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
 import { CredentialsHandlerFunction } from "./credentials-handler-function";
 
+/**
+ * Props for CredentialsHandlerFunction
+ */
+export interface CredentialsProviderProps {
+  /**
+   * The region of SES endpoint to use. Defaults to stack region.
+   */
+  region: string;
+}
+
 export class CredentialsProvider extends Construct {
   /**
    * Retrieve CredentialsProvider as stack singleton resource.
    *
    * https://github.com/aws/aws-cdk/issues/5023
    */
-  public static getOrCreate(scope: Construct): CredentialsProvider {
+  public static getOrCreate(scope: Construct, props: CredentialsProviderProps): CredentialsProvider {
     const stack = Stack.of(scope);
     const id = "cdk-ses-smtp-credentials.CredentialsProvider";
     const existing = stack.node.tryFindChild(id);
-    return (existing as CredentialsProvider) || new CredentialsProvider(stack, id);
+    return (existing as CredentialsProvider) || new CredentialsProvider(stack, id, { region: props.region });
   }
 
   public readonly serviceToken: string;
@@ -24,7 +34,7 @@ export class CredentialsProvider extends Construct {
   private userArns: string[] = [];
   private secretArns: string[] = [];
 
-  constructor(scope: Construct, id: string) {
+  constructor(scope: Construct, id: string, props: CredentialsProviderProps) {
     super(scope, id);
 
     // https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-nodejs-readme.html
@@ -50,6 +60,8 @@ export class CredentialsProvider extends Construct {
       ],
       logRetention: RetentionDays.ONE_MONTH,
     });
+    // register ses-region for auto-generated lambda function
+    onEvent.addEnvironment("SES_REGION", props.region, { removeInEdge: true });
 
     const provider = new Provider(this, "ses-smtp-credentials-provider", {
       onEventHandler: onEvent,
diff --git a/src/ses-smtp-credentials.ts b/src/ses-smtp-credentials.ts
index aebf5779..309872f9 100644
--- a/src/ses-smtp-credentials.ts
+++ b/src/ses-smtp-credentials.ts
@@ -6,6 +6,10 @@ import { CredentialsProvider } from "./provider/credentials-provider";
 import { SMTP_REGIONS } from "./provider/ses-smtp-regions";
 
 export interface SesSmtpCredentialsProps {
+  /**
+   * The region of SES endpoint to use. Defaults to stack region.
+   */
+  readonly region?: string;
   /**
    * The user for which to create an AWS Access Key and to generate the smtp password. If omitted a user will be created.
    */
@@ -62,7 +66,7 @@ export class SesSmtpCredentials extends Construct {
   public constructor(scope: Construct, id: string, props: SesSmtpCredentialsProps) {
     super(scope, id);
 
-    const region = Stack.of(this).region;
+    const region = props.region ?? Stack.of(this).region;
     if (!SMTP_REGIONS.includes(region)) {
       Annotations.of(this).addWarning(
         `AWS SES Smtp Endpoint is not available in region ${region}\n see https://docs.aws.amazon.com/general/latest/gr/ses.html`,
@@ -93,7 +97,7 @@ export class SesSmtpCredentials extends Construct {
         description: `SES Smtp Credentials (username, password) for ${user.userName}`,
       });
 
-    const provider = CredentialsProvider.getOrCreate(this);
+    const provider = CredentialsProvider.getOrCreate(this, { region: region });
     provider.grant(user, this.secret);
 
     const customResource = new CustomResource(this, "Lambda", {
diff --git a/test/__snapshots__/integ.default.test.ts.snap b/test/__snapshots__/integ.default.test.ts.snap
index 57b317b1..27b16807 100644
--- a/test/__snapshots__/integ.default.test.ts.snap
+++ b/test/__snapshots__/integ.default.test.ts.snap
@@ -300,12 +300,15 @@ Object {
           "S3Bucket": Object {
             "Fn::Sub": "cdk-hnb659fds-assets-\${AWS::AccountId}-\${AWS::Region}",
           },
-          "S3Key": "681d284a27fcbbccf41227929a9c13895a5859749b289f961ca68f3b8d47d137.zip",
+          "S3Key": "30ae0a5aea83da37a1a31b797d9d051f0f3130f3be49a4166ddced23d20741da.zip",
         },
         "Description": "src/provider/credentials-handler.lambda.ts",
         "Environment": Object {
           "Variables": Object {
             "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1",
+            "SES_REGION": Object {
+              "Ref": "AWS::Region",
+            },
           },
         },
         "Handler": "index.handler",
diff --git a/test/provider/__snapshots__/credentials-provider.test.ts.snap b/test/provider/__snapshots__/credentials-provider.test.ts.snap
index 01fe032c..cf0264a8 100644
--- a/test/provider/__snapshots__/credentials-provider.test.ts.snap
+++ b/test/provider/__snapshots__/credentials-provider.test.ts.snap
@@ -242,12 +242,13 @@ Object {
           "S3Bucket": Object {
             "Fn::Sub": "cdk-hnb659fds-assets-\${AWS::AccountId}-\${AWS::Region}",
           },
-          "S3Key": "681d284a27fcbbccf41227929a9c13895a5859749b289f961ca68f3b8d47d137.zip",
+          "S3Key": "30ae0a5aea83da37a1a31b797d9d051f0f3130f3be49a4166ddced23d20741da.zip",
         },
         "Description": "src/provider/credentials-handler.lambda.ts",
         "Environment": Object {
           "Variables": Object {
             "AWS_NODEJS_CONNECTION_REUSE_ENABLED": "1",
+            "SES_REGION": "us-east-1",
           },
         },
         "Handler": "index.handler",
diff --git a/test/provider/credentials-handler-function.test.ts b/test/provider/credentials-handler-function.test.ts
index 5d4bcb9b..628629d9 100644
--- a/test/provider/credentials-handler-function.test.ts
+++ b/test/provider/credentials-handler-function.test.ts
@@ -7,7 +7,7 @@ import * as sinon from "sinon";
 describe("provider.credentials-handler.lambda", () => {
   jest.setTimeout(60_000);
   console.log = jest.fn();
-  process.env.AWS_DEFAULT_REGION = "us-east-1";
+  process.env.SES_REGION = "us-east-1";
 
   let handler: (event: OnEventRequest) => Promise<OnEventResponse | undefined>;
   beforeEach(async () => {
diff --git a/test/provider/credentials-provider.test.ts b/test/provider/credentials-provider.test.ts
index 5a5c57df..d53f0b2a 100644
--- a/test/provider/credentials-provider.test.ts
+++ b/test/provider/credentials-provider.test.ts
@@ -12,7 +12,7 @@ describe("CredentialsProvider", () => {
     const user = new User(stack, "User");
     const secret = new Secret(stack, "Secret");
 
-    const provider = CredentialsProvider.getOrCreate(stack);
+    const provider = CredentialsProvider.getOrCreate(stack, { region: "us-east-1" });
     provider.grant(user, secret);
 
     // When
@@ -28,7 +28,7 @@ describe("CredentialsProvider", () => {
     const user = new User(stack, "User");
     const secret = new Secret(stack, "Secret");
 
-    const provider = CredentialsProvider.getOrCreate(stack);
+    const provider = CredentialsProvider.getOrCreate(stack, { region: "us-east-1" });
     provider.grant(user, secret);
 
     // When