Granular permissions (#9922)

Set granular permissions to TXT DNS records with names starting with `_acme-challenge.` only This replaces original policy that is too permissive The `Condition` clause uses [Route 53 resource record set permission](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-permissions.html) Policy tested with Certbot 2.9.0
2026-07-23 14:23:53 +02:00 · 2026-02-02 11:18:05 -08:00
parent 991ecd7c8e
commit 88af129315
1 changed files with 13 additions and 1 deletions
@@ -19,7 +19,19 @@
            ],
            "Resource" : [
                "arn:aws:route53:::hostedzone/YOURHOSTEDZONEID"
-            ]
+            ],
+            "Condition": {
+                "ForAllValues:StringLike": {
+                    "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
+                        "_acme-challenge.*"
+                    ]
+                },
+                "ForAllValues:StringEquals": {
+                    "route53:ChangeResourceRecordSetsRecordTypes": [
+                        "TXT"
+                    ]
+                }
+            }
        }
    ]
 }