Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Route 53

Amazon Route 53 (service prefix: route53) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Route 53
Actions defined by Amazon Route 53
Resource types defined by Amazon Route 53
Condition keys for Amazon Route 53

API operations defined by Amazon Route 53

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
ActivateKeySigningKey	route53:ActivateKeySigningKey	Write
AssociateVPCWithHostedZone	route53:AssociateVPCWithHostedZone	Write
ChangeCidrCollection	route53:ChangeCidrCollection	Write
ChangeResourceRecordSets	route53:ChangeResourceRecordSets	Write
ChangeTagsForResource	route53:ChangeTagsForResource	Tagging, Write
CreateCidrCollection	route53:CreateCidrCollection	Write
CreateHealthCheck	route53:CreateHealthCheck	Write
CreateHostedZone	route53:CreateHostedZone	Write
CreateKeySigningKey	route53:CreateKeySigningKey	Write
CreateQueryLoggingConfig	route53:CreateQueryLoggingConfig	Write
CreateReusableDelegationSet	route53:CreateReusableDelegationSet	Write
CreateTrafficPolicy	route53:CreateTrafficPolicy	Write
CreateTrafficPolicyInstance	route53:CreateTrafficPolicyInstance	Write
CreateTrafficPolicyVersion	route53:CreateTrafficPolicyVersion	Write
CreateVPCAssociationAuthorization	route53:CreateVPCAssociationAuthorization	Write
DeactivateKeySigningKey	route53:DeactivateKeySigningKey	Write
DeleteCidrCollection	route53:DeleteCidrCollection	Write
DeleteHealthCheck	route53:DeleteHealthCheck	Write
DeleteHostedZone	route53:DeleteHostedZone	Write
DeleteKeySigningKey	route53:DeleteKeySigningKey	Write
DeleteQueryLoggingConfig	route53:DeleteQueryLoggingConfig	Write
DeleteReusableDelegationSet	route53:DeleteReusableDelegationSet	Write
DeleteTrafficPolicy	route53:DeleteTrafficPolicy	Write
DeleteTrafficPolicyInstance	route53:DeleteTrafficPolicyInstance	Write
DeleteVPCAssociationAuthorization	route53:DeleteVPCAssociationAuthorization	Write
DisableHostedZoneDNSSEC	route53:DisableHostedZoneDNSSEC	Write
DisassociateVPCFromHostedZone	route53:DisassociateVPCFromHostedZone	Write
EnableHostedZoneDNSSEC	route53:EnableHostedZoneDNSSEC	Write
GetAccountLimit	route53:GetAccountLimit	Read
GetChange	route53:GetChange	List
GetCheckerIpRanges	route53:GetCheckerIpRanges	List
GetDNSSEC	route53:GetDNSSEC	Read
GetGeoLocation	route53:GetGeoLocation	List
GetHealthCheck	route53:GetHealthCheck	Read
GetHealthCheckCount	route53:GetHealthCheckCount	List
GetHealthCheckLastFailureReason	route53:GetHealthCheckLastFailureReason	List
GetHealthCheckStatus	route53:GetHealthCheckStatus	List
GetHostedZone	route53:GetHostedZone	List
GetHostedZoneCount	route53:GetHostedZoneCount	List
GetHostedZoneLimit	route53:GetHostedZoneLimit	Read
GetQueryLoggingConfig	route53:GetQueryLoggingConfig	Read
GetReusableDelegationSet	route53:GetReusableDelegationSet	List
GetReusableDelegationSetLimit	route53:GetReusableDelegationSetLimit	Read
GetTrafficPolicy	route53:GetTrafficPolicy	Read
GetTrafficPolicyInstance	route53:GetTrafficPolicyInstance	Read
GetTrafficPolicyInstanceCount	route53:GetTrafficPolicyInstanceCount	Read
ListCidrBlocks	route53:ListCidrBlocks	List
ListCidrCollections	route53:ListCidrCollections	List
ListCidrLocations	route53:ListCidrLocations	List
ListGeoLocations	route53:ListGeoLocations	Read
ListHealthChecks	route53:ListHealthChecks	Read
ListHostedZones	route53:ListHostedZones	List
ListHostedZonesByName	route53:ListHostedZonesByName	List
ListHostedZonesByVPC	route53:ListHostedZonesByVPC	List
ListQueryLoggingConfigs	route53:ListQueryLoggingConfigs	List
ListResourceRecordSets	route53:ListResourceRecordSets	List
ListReusableDelegationSets	route53:ListReusableDelegationSets	Read
ListTagsForResource	route53:ListTagsForResource	Read
ListTagsForResources	route53:ListTagsForResources	Read
ListTrafficPolicies	route53:ListTrafficPolicies	List
ListTrafficPolicyInstances	route53:ListTrafficPolicyInstances	Read
ListTrafficPolicyInstancesByHostedZone	route53:ListTrafficPolicyInstancesByHostedZone	List
ListTrafficPolicyInstancesByPolicy	route53:ListTrafficPolicyInstancesByPolicy	List
ListTrafficPolicyVersions	route53:ListTrafficPolicyVersions	List
ListVPCAssociationAuthorizations	route53:ListVPCAssociationAuthorizations	List
TestDNSAnswer	route53:TestDNSAnswer	Read
UpdateHealthCheck	route53:UpdateHealthCheck	Write
UpdateHostedZoneComment	route53:UpdateHostedZoneComment	Write
UpdateHostedZoneFeatures	route53:UpdateHostedZoneFeatures	Write
UpdateTrafficPolicyComment	route53:UpdateTrafficPolicyComment	Write
UpdateTrafficPolicyInstance	route53:UpdateTrafficPolicyInstance	Write

Actions defined by Amazon Route 53

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivateKeySigningKey	Grants permission to activate a key-signing key so that it can be used for signing by DNSSEC	hostedzone*		Write
AssociateVPCWithHostedZone	Grants permission to associate an additional Amazon VPC with a private hosted zone	hostedzone	route53:VPCs	Write
ChangeCidrCollection	Grants permission to create or delete CIDR blocks within a CIDR collection	cidrcollection*		Write
ChangeResourceRecordSets	Grants permission to create, update, or delete a record, which contains authoritative DNS information for a specified domain or subdomain name	hostedzone*	route53:ChangeResourceRecordSetsActions route53:ChangeResourceRecordSetsNormalizedRecordNames route53:ChangeResourceRecordSetsRecordTypes	Write
ChangeTagsForResource	Grants permission to add, edit, or delete tags for a health check or a hosted zone	healthcheck*		Tagging, Write
ChangeTagsForResource		hostedzone*		Tagging, Write
CreateCidrCollection	Grants permission to create a new CIDR collection			Write
CreateHealthCheck	Grants permission to create a new health check, which monitors the health and performance of your web applications, web servers, and other resources			Write
CreateHostedZone	Grants permission to create a public hosted zone, which you use to specify how the Domain Name System (DNS) routes traffic on the Internet for a domain, such as example.com, and its subdomains		route53:VPCs	Write
CreateKeySigningKey	Grants permission to create a new key-signing key associated with a hosted zone	hostedzone*		Write
CreateQueryLoggingConfig	Grants permission to create a configuration for DNS query logging	hostedzone*		Write
CreateReusableDelegationSet	Grants permission to create a delegation set (a group of four name servers) that can be reused by multiple hosted zones			Write
CreateTrafficPolicy	Grants permission to create a traffic policy, which you use to create multiple DNS records for one domain name (such as example.com) or one subdomain name (such as www.example.com)			Write
CreateTrafficPolicyInstance	Grants permission to create records in a specified hosted zone based on the settings in a specified traffic policy version	hostedzone*		Write
CreateTrafficPolicyInstance		trafficpolicy*		Write
CreateTrafficPolicyVersion	Grants permission to create a new version of an existing traffic policy	trafficpolicy*		Write
CreateVPCAssociationAuthorization	Grants permission to authorize the Amazon Web Services account that created a specified VPC to submit an AssociateVPCWithHostedZone request, which associates the VPC with a specified hosted zone that was created by a different account	hostedzone*	route53:VPCs	Write
DeactivateKeySigningKey	Grants permission to deactivate a key-signing key so that it will not be used for signing by DNSSEC	hostedzone*		Write
DeleteCidrCollection	Grants permission to delete a CIDR collection	cidrcollection*		Write
DeleteHealthCheck	Grants permission to delete a health check	healthcheck*		Write
DeleteHostedZone	Grants permission to delete a hosted zone	hostedzone*		Write
DeleteKeySigningKey	Grants permission to delete a key-signing key	hostedzone*		Write
DeleteQueryLoggingConfig	Grants permission to delete a configuration for DNS query logging	queryloggingconfig*		Write
DeleteReusableDelegationSet	Grants permission to delete a reusable delegation set	delegationset*		Write
DeleteTrafficPolicy	Grants permission to delete a traffic policy	trafficpolicy*		Write
DeleteTrafficPolicyInstance	Grants permission to delete a traffic policy instance and all the records that Route 53 created when you created the instance	trafficpolicyinstance*		Write
DeleteVPCAssociationAuthorization	Grants permission to remove authorization for associating an Amazon Virtual Private Cloud with a Route 53 private hosted zone	hostedzone*	route53:VPCs	Write
DisableHostedZoneDNSSEC	Grants permission to disable DNSSEC signing in a specific hosted zone	hostedzone*		Write
DisassociateVPCFromHostedZone	Grants permission to disassociate an Amazon Virtual Private Cloud from a Route 53 private hosted zone	hostedzone	route53:VPCs	Write
EnableHostedZoneDNSSEC	Grants permission to enable DNSSEC signing in a specific hosted zone	hostedzone*		Write
GetAccountLimit	Grants permission to get the specified limit for the current account, for example, the maximum number of health checks that you can create using the account			Read
GetChange	Grants permission to get the current status of a request to create, update, or delete one or more records	change*		List
GetCheckerIpRanges	Grants permission to get a list of the IP ranges that are used by Route 53 health checkers to check the health of your resources			List
GetDNSSEC	Grants permission to get information about DNSSEC for a specific hosted zone, including the key-signing keys in the hosted zone	hostedzone*		Read
GetGeoLocation	Grants permission to get information about whether a specified geographic location is supported for Route 53 geolocation records			List
GetHealthCheck	Grants permission to get information about a specified health check	healthcheck*		Read
GetHealthCheckCount	Grants permission to get the number of health checks that are associated with the current Amazon Web Services account			List
GetHealthCheckLastFailureReason	Grants permission to get the reason that a specified health check failed most recently	healthcheck*		List
GetHealthCheckStatus	Grants permission to get the status of a specified health check	healthcheck*		List
GetHostedZone	Grants permission to get information about a specified hosted zone including the four name servers that Route 53 assigned to the hosted zone	hostedzone*		List
GetHostedZoneCount	Grants permission to get the number of hosted zones that are associated with the current Amazon Web Services account			List
GetHostedZoneLimit	Grants permission to get the specified limit for a specified hosted zone	hostedzone*		Read
GetQueryLoggingConfig	Grants permission to get information about a specified configuration for DNS query logging	queryloggingconfig*		Read
GetReusableDelegationSet	Grants permission to get information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set	delegationset*		List
GetReusableDelegationSetLimit	Grants permission to get the maximum number of hosted zones that you can associate with the specified reusable delegation set	delegationset*		Read
GetTrafficPolicy	Grants permission to get information about a specified traffic policy version	trafficpolicy*		Read
GetTrafficPolicyInstance	Grants permission to get information about a specified traffic policy instance	trafficpolicyinstance*		Read
GetTrafficPolicyInstanceCount	Grants permission to get the number of traffic policy instances that are associated with the current Amazon Web Services account			Read
ListCidrBlocks	Grants permission to get a list of the CIDR blocks within a specified CIDR collection	cidrcollection*		List
ListCidrCollections	Grants permission to get a list of the CIDR collections that are associated with the current Amazon Web Services account			List
ListCidrLocations	Grants permission to get a list of the CIDR locations that belong to a specified CIDR collection	cidrcollection*		List
ListGeoLocations	Grants permission to get a list of geographic locations that Route 53 supports for geolocation			Read
ListHealthChecks	Grants permission to get a list of the health checks that are associated with the current Amazon Web Services account			Read
ListHostedZones	Grants permission to get a list of the public and private hosted zones that are associated with the current Amazon Web Services account			List
ListHostedZonesByName	Grants permission to get a list of your hosted zones in lexicographic order. Hosted zones are sorted by name with the labels reversed, for example, com.example.www			List
ListHostedZonesByVPC	Grants permission to get a list of all the private hosted zones that a specified VPC is associated with		route53:VPCs	List
ListQueryLoggingConfigs	Grants permission to list the configurations for DNS query logging that are associated with the current Amazon Web Services account or the configuration that is associated with a specified hosted zone	hostedzone		List
ListResourceRecordSets	Grants permission to list the records in a specified hosted zone	hostedzone*		List
ListReusableDelegationSets	Grants permission to list the reusable delegation sets that are associated with the current Amazon Web Services account.			Read
ListTagsForResource	Grants permission to list tags for one health check or hosted zone	healthcheck		Read
ListTagsForResource		hostedzone		Read
ListTagsForResources	Grants permission to list tags for up to 10 health checks or hosted zones	healthcheck		Read
ListTagsForResources		hostedzone		Read
ListTrafficPolicies	Grants permission to get information about the latest version for every traffic policy that is associated with the current Amazon Web Services account. Policies are listed in the order in which they were created			List
ListTrafficPolicyInstances	Grants permission to get information about the traffic policy instances that you created by using the current Amazon Web Services account			Read
ListTrafficPolicyInstancesByHostedZone	Grants permission to get information about the traffic policy instances that you created in a specified hosted zone	hostedzone*		List
ListTrafficPolicyInstancesByPolicy	Grants permission to get information about the traffic policy instances that you created using a specified traffic policy version	trafficpolicy*		List
ListTrafficPolicyVersions	Grants permission to get information about all the versions for a specified traffic policy	trafficpolicy*		List
ListVPCAssociationAuthorizations	Grants permission to get a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone	hostedzone*		List
TestDNSAnswer	Grants permission to get the value that Route 53 returns in response to a DNS query for a specified record name and type			Read
UpdateHealthCheck	Grants permission to update an existing health check	healthcheck*		Write
UpdateHostedZoneComment	Grants permission to update the comment for a specified hosted zone	hostedzone*		Write
UpdateHostedZoneFeatures	Grants permission to update features for a specified hosted zone	hostedzone*		Write
UpdateTrafficPolicyComment	Grants permission to update the comment for a specified traffic policy version	trafficpolicy*		Write
UpdateTrafficPolicyInstance	Grants permission to update the records in a specified hosted zone that were created based on the settings in a specified traffic policy version	trafficpolicyinstance*		Write

Resource types defined by Amazon Route 53

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
change	arn:${Partition}:route53:::change/${Id}
cidrcollection	arn:${Partition}:route53:::cidrcollection/${Id}
delegationset	arn:${Partition}:route53:::delegationset/${Id}
healthcheck	arn:${Partition}:route53:::healthcheck/${Id}
hostedzone	arn:${Partition}:route53:::hostedzone/${Id}
queryloggingconfig	arn:${Partition}:route53:::queryloggingconfig/${Id}
trafficpolicy	arn:${Partition}:route53:::trafficpolicy/${Id}
trafficpolicyinstance	arn:${Partition}:route53:::trafficpolicyinstance/${Id}
vpc	arn:${Partition}:ec2:${Region}:${Account}:vpc/${VpcId}

Condition keys for Amazon Route 53

Amazon Route 53 defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
route53:ChangeResourceRecordSetsActions	Filters access by the change actions, CREATE, UPSERT, or DELETE, in a ChangeResourceRecordSets request	ArrayOfString
route53:ChangeResourceRecordSetsNormalizedRecordNames	Filters access by the normalized DNS record names in a ChangeResourceRecordSets request	ArrayOfString
route53:ChangeResourceRecordSetsRecordTypes	Filters access by the DNS record types in a ChangeResourceRecordSets request	ArrayOfString
route53:VPCs	Filters access by VPCs in request	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Resource Group Tagging API (tag)

Amazon Route 53 Profiles (route53profiles)