4 ms·
Route53/IAM doesn't have any way to restrict access to only _acme-challenge DNS labels. Use RFC2136 like civilized folk, I guess. ¯\_(ツ)_/¯
by regecks 8y ago
Route53/IAM doesn't have any way to restrict access to only _acme-challenge DNS labels.
Use RFC2136 like civilized folk, I guess. ¯\_(ツ)_/¯
- bashinator 8y agoI'm a little surprised that route53 IAM policies aren't granular enough to restrict access to specific records or record types. It seems obvious that a service (lambda or such) should be able to issue cert autorenewal records without any other route53 access, and I wouldn't be surprised if this were already on a roadmap.