starred/certbot-certbot-2
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-02 00:22:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Granular permissions (#9922)

Browse Source 
Set granular permissions to TXT DNS records with names starting with
`_acme-challenge.` only
This replaces original policy that is too permissive

The `Condition` clause uses [Route 53 resource record set
permission](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-permissions.html)

Policy tested with Certbot 2.9.0
This commit is contained in:
Mike Lim
2026-02-02 11:18:05 -08:00
committed by GitHub
parent 991ecd7c8e
commit 88af129315
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot-dns-route53/examples/sample-aws-policy.json
+13 -1
View File
@@ -19,7 +19,19 @@
], ],
"Resource" : [ "Resource" : [
"arn:aws:route53:::hostedzone/YOURHOSTEDZONEID" "arn:aws:route53:::hostedzone/YOURHOSTEDZONEID"
] ],
"Condition": {
"ForAllValues:StringLike": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"_acme-challenge.*"
]
},
"ForAllValues:StringEquals": {
"route53:ChangeResourceRecordSetsRecordTypes": [
"TXT"
]
}
}
} }
] ]
} }