4

I need to give an IAM user Route 53 access to create records under a subdomain, say data.example.com. For example, the user should be able to create a CNAME for server1.data.example.com. At the same time, I don't want the user to be able to add/modify/delete any records other than *.data.example.com.

Is it possible to write a policy that does that?

lfk
  • 2,423
  • 6
  • 29
  • 46

2 Answers2

12

You can restrict by hosted zone, but not by sub-domain. Your Route53 hosted zones should be split up by subdomain if you'd like to restrict to specific subdomains. You can create a hosted zone for a subdomain:

For example if you wanted a subdomain named test you can do as the answer here summarizes well:

Create a hosted zone for test.example.com.

Note the 4 name servers that Route 53 assigns to it the new hosted zone.

Back in the master zone, create a new resource record, with hostname "test" using record type NS, and enter the 4 name servers that Route 53 assigned, in the box below.

The above delegates control of that subdomain to this new hosted zone, which has a unique zone id we can use in an IAM policy

You can then build an IAM policy that restricts actions to this zone:

{
   "Statement":[
      {
         "Action":[
            "route53:*"
         ],
         "Effect":"Allow",
         "Resource":[
            "arn:aws:route53:::hostedzone/<The new zone ID>"
         ]
      },
      {
         "Action":[
            "route53:ListHostedZones"
         ],
         "Effect":"Allow",
         "Resource":[
            "*"
         ]
      }
   ]
}

From here you can tweak this policy to fit the actions you'd like the user to be able to take in this zone.

Brandon Miller
  • 4,695
  • 1
  • 20
  • 27
1

From the AWS Documentation

In a policy, you can grant or deny access to the following resources by using * for the ARN:

  • Health checks
  • Hosted zones
  • Reusable delegation sets
  • Status of a resource record set change batch (API only)
  • Traffic policies (traffic flow)
  • Traffic policy instances (traffic flow)

Not all Route 53 resources support permissions. You can't grant or deny access to the following resources:

  • Domains
  • Individual records
  • Namespaces (service discovery)
  • Services (service discovery)
  • Tags for domains
  • Tags for health checks
  • Tags for hosted zones

It basically means IAM finest grain control is individual hosted zone (DNS zone file).

You can create a hosted zone only for the particular subdomain by following this AWS Guide

Gapton
  • 2,044
  • 2
  • 20
  • 33