How to get AWS Route 53 access keys

Route 53 has no API token. You make an IAM user, give it Route 53 permissions, and generate an access key for it. Do not use your root account for this, and do not reuse the key of a person. A separate user can be switched off without breaking anything else.

Create the IAM user

1. Sign in to the AWS Management Console and open IAM.
2. Go to Users > Create user. Name it dnsense. It does not need console access.
3. On the permissions step choose Attach policies directly and add:
   • AmazonRoute53FullAccess for hosted zones and records.
   • AmazonRoute53DomainsFullAccess only if you want DNSense to work with domains registered in Route 53.
4. Finish creating the user.

If you prefer least privilege, write your own policy that allows the route53:* and route53domains:* actions DNSense needs. The two managed policies are the quick route.

Create the access key

1. In IAM > Users, open the dnsense user.
2. On the Security credentials tab, find Access keys and click Create access key. If the button is greyed out, the user already has two keys. Delete one first.
3. AWS shows a page of best practices and alternatives. Pick Other and continue. DNSense runs outside AWS, so the alternatives do not apply.
4. Add a description tag if you like, then click Create access key.
5. Click Show to reveal the secret access key. Copy it, or use Download .csv file. AWS shows it only now and cannot recover it later.

Connect it to DNSense

Add a connection, choose AWS Route 53 and fill in:

• Access key ID, the one starting with AKIA.
• Secret access key.
• Session token, only when you use temporary STS credentials. Leave it empty for a normal access key.

No region is needed. Hosted zones are global, and domain registration only exists on the us-east-1 endpoint, which DNSense uses itself.

Rotating the key

Create a second key, put it in DNSense, check that the connection still works, then deactivate and delete the old key. An IAM user can hold two keys at once for exactly this reason.