---
title: "How to get AWS Route 53 access keys"
description: "Create a dedicated IAM user for DNSense, attach the Route 53 policies and generate an access key and secret."
canonical_url: "https://dnsense.io/learn/how-to-get-aws-route-53-access-keys"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

Route 53 has no API token. You make an IAM user, give it Route 53 permissions, and generate an access key for it. Do not use your root account for this, and do not reuse the key of a person. A separate user can be switched off without breaking anything else.

## Create the IAM user

1. Sign in to the AWS Management Console and open **IAM**.
2. Go to **Users > Create user**. Name it `dnsense`. It does not need console access.
3. On the permissions step choose **Attach policies directly** and add:

  - **AmazonRoute53FullAccess** for hosted zones and records.
  - **AmazonRoute53DomainsFullAccess** only if you want DNSense to work with domains registered in Route 53.
4. Finish creating the user.

If you prefer least privilege, write your own policy that allows the `route53:*` and `route53domains:*` actions DNSense needs. The two managed policies are the quick route.

## Create the access key

1. In **IAM > Users**, open the `dnsense` user.
2. On the **Security credentials** tab, find **Access keys** and click **Create access key**. If the button is greyed out, the user already has two keys. Delete one first.
3. AWS shows a page of best practices and alternatives. Pick **Other** and continue. DNSense runs outside AWS, so the alternatives do not apply.
4. Add a description tag if you like, then click **Create access key**.
5. Click **Show** to reveal the **secret access key**. Copy it, or use **Download .csv file**. AWS shows it only now and cannot recover it later.

## Connect it to DNSense

Add a connection, choose **AWS Route 53** and fill in:

- **Access key ID**, the one starting with `AKIA`.
- **Secret access key**.
- **Session token**, only when you use temporary STS credentials. Leave it empty for a normal access key.

No region is needed. Hosted zones are global, and domain registration only exists on the `us-east-1` endpoint, which DNSense uses itself.

## Rotating the key

Create a second key, put it in DNSense, check that the connection still works, then deactivate and delete the old key. An IAM user can hold two keys at once for exactly this reason.

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.