Amazon Route 53 API permissions: Actions, resources, and conditions reference

When you set up Access control and write a permissions policy that you can attach to an IAM identity (identity-based policies), you can use the lists of Actions, resources, and condition keys for Route 53, Actions, resources, and condition keys for Route 53 Domains, and Actions, resources, and condition keys for Route 53 Resolver in the Service Authorization Reference. The pages include each Amazon Route 53 API action, the actions that you must grant permissions access to, and the AWS resource that you must grant access to. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

You can use AWS-wide condition keys in your Route 53 policies to express conditions. For a complete list of AWS-wide keys, see Available keys in the IAM User Guide.

Note

When granting access, the hosted zone and the Amazon VPC must belong to the same partition. A partition is a group of AWS Regions. Each AWS account is scoped to one partition.

The following are the supported partitions:

• aws - AWS Regions

• aws-cn - China Regions

• aws-us-gov - AWS GovCloud (US) Region

For more information, see Access Management in the AWS General Reference.

Note

To specify an action, use the applicable prefix (route53, route53domains, or route53resolver) followed by the API operation name, for example:

• route53:CreateHostedZone

• route53domains:RegisterDomain

• route53resolver:CreateResolverEndpoint