Amazon Route 53
Route 53 IAM role setup: launch the prefilled CloudFormation stack, then paste its RoleArn; DNSMigrator never asks you for AWS access keys.
On this page
Route 53 IAM role permissions
- Credential type
- cross-account IAM role
- Preview access
- route53:ListHostedZones, route53:ListResourceRecordSets
- Apply access
- route53:ListHostedZonesByName, route53:GetHostedZone, route53:ChangeResourceRecordSets, route53:CreateHostedZone, route53:GetChange
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "ROUTE53"
}Create credentials
Launch the prefilled CloudFormation stack, then paste its RoleArn; DNSMigrator never asks you for AWS access keys.
Access you'll grant
route53:ListHostedZones, route53:ListResourceRecordSets
route53:ListHostedZonesByName, route53:GetHostedZone, route53:ChangeResourceRecordSets, route53:CreateHostedZone, route53:GetChange
Before you start
- An AWS account containing the public Route 53 hosted zones you want to use.
- Permission to create a CloudFormation stack with a named IAM role and inline policies.
- For automated cutover of an AWS-registered domain, the domain must be in Route 53 Domains in the same account and the role needs the optional registrar policy below.
Setup steps
0 of 6 done
Choose the access level
Leave Include write access (needed to apply to Route 53) clear for a read-only preview. Select it if this connection will create a hosted zone or apply record changes.
Previewroute53:ListHostedZones, route53:ListResourceRecordSetsApply addsroute53:ChangeResourceRecordSets, route53:CreateHostedZoneOpen the one-click stack
Select Open CloudFormation and sign in to the AWS account that owns the hosted zones. The quick-create link supplies your workspace's External ID, DNSMigrator's trusted AWS account, and your write-access choice.
Create the CloudFormation stack
On Quick create stack, verify Stack name, ExternalId, TrustedAccountId, and AllowWrite. Complete the IAM acknowledgment under Capabilities, then select Create stack. Don't replace the prefilled external ID.
Screenshot: AWS Documentation, CC BY-SA 4.0
Copy the role ARN
Wait for Stack status to become
CREATE_COMPLETE, open the stack's Outputs tab, and copy the value beside RoleArn.Add Route 53 Domains access (optional)
Do this only when DNSMigrator will cut over a domain registered with Route 53 Domains. In IAM → Roles, open the role named at the end of the RoleArn, then choose Add permissions → Create inline policy → JSON. Paste this policy, continue to Review and create, name it
DNSMigratorRoute53Domains, and select Create policy. Route 53 Domains doesn't support resource-level permissions for these actions.Registrar cutover policy{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53domains:ListDomains", "route53domains:GetDomainDetail", "route53domains:GetOperationDetail", "route53domains:UpdateDomainNameservers", "route53domains:AssociateDelegationSignerToDomain", "route53domains:DisassociateDelegationSignerFromDomain" ], "Resource": "*" } ] }Paste the Role ARN
Return here and paste the complete
arn:aws:iam::…:role/…value into Role ARN. The workspace External ID is supplied by the server; don't create or paste an access key.
Troubleshooting
CloudFormation says the stack already exists
Open the existing DNSMigratorAccess stack and copy RoleArn from Outputs. To change access, update that stack and change the AllowWrite parameter instead of creating a duplicate stack with the same name.
“Couldn't assume the IAM role”
Copy RoleArn again from the current stack output. If the role's trust policy was edited, restore DNSMigrator's trusted account and the exact workspace external ID by updating or relaunching the provided stack.
Preview works but apply returns AccessDenied
Update the CloudFormation stack and set AllowWrite to true. Also check whether an AWS Organizations service control policy or IAM permissions boundary denies Route 53 writes.
Route 53 Domains cutover returns AccessDeniedException
The one-click stack doesn't include registrar actions. Add the inline DNSMigratorRoute53Domains policy from step 5 to the same role.
Official documentation
- CloudFormation quick-create links
- AWS access for third parties with an external ID
- Route 53 IAM policy examples
- Route 53 Domains API operations
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Role ARNroleArn | Required | CloudFormation → your DNSMigrator stack → Outputs → RoleArn. Copy the complete ARN, including arn:aws:iam:: and the role path. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- 0 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- DS
- HTTPS
- SVCB
- TLSA
- SSHFP
- NAPTR
- SPF
Caveats
- Alias records can only target AWS resources or records in the same hosted zone.
- Weighted, latency, geolocation and failover routing are Route 53 features. Most other providers can't reproduce them.
- Apex CNAMEs are not allowed. Use an alias record instead.
Troubleshooting
- CloudFormation says the stack already exists
- Open the existing DNSMigratorAccess stack and copy RoleArn from Outputs. To change access, update that stack and change the AllowWrite parameter instead of creating a duplicate stack with the same name.
- “Couldn't assume the IAM role”
- Copy RoleArn again from the current stack output. If the role's trust policy was edited, restore DNSMigrator's trusted account and the exact workspace external ID by updating or relaunching the provided stack.
- Preview works but apply returns AccessDenied
- Update the CloudFormation stack and set AllowWrite to true. Also check whether an AWS Organizations service control policy or IAM permissions boundary denies Route 53 writes.
- Route 53 Domains cutover returns AccessDeniedException
- The one-click stack doesn't include registrar actions. Add the inline DNSMigratorRoute53Domains policy from step 5 to the same role.