Route 53 IAM Permissions

Route 53 IAM Permissions

To enable Route 53 updates for the Bespoke Dynamic DNS Updater, the account which is used for the updater needs these permissions, at a minimum, to perform updates: ChangeResourceRecordSets & ListHostedZones

The policy documents below can be attached as user policies for the user whose credentials are passed to the updater. Items that are to be replaced are denoted in all caps and between braces. For the ChangeResourceRecordsSets policy, enter an asterisk for the {HOSTED_ZONE_ID} to enable updates for all hosted zones under the AWS account. The {SID} is an optional identifier that you can set yourself, or omit altogether.

ChangeResourceRecordsSets Policy Document:

{
  "Statement": [
    {
      "Sid": "{SID}",
      "Action": [
        "route53:ChangeResourceRecordSets"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:route53:::hostedzone/{HOSTED_ZONE_ID}"
      ]
    }
  ]
}

ListHostedZones Policy Document:

{
  "Statement": [
    {
      "Sid": "{SID}",
      "Action": [
        "route53:ListHostedZones"
      ],
      "Effect": "Allow",
      "Resource": [
        "*"
      ]
    }
  ]
}