AWS Route53 documentation change
Summary
Added new IAM permissions related to CloudFront multi-tenant distributions, CloudWatch alarms/metrics, EC2 VPCs, OpenSearch domains, Lightsail containers, and tag resources. Updated AmazonRoute53FullAccess policy documentation with new permissions.
Security assessment
The changes document required IAM permissions for various AWS service integrations but do not indicate any security vulnerability being fixed. This is routine documentation of necessary permissions for console functionality rather than addressing a security incident.
Diff
diff --git a/Route53/latest/DeveloperGuide/security-iam-awsmanpol-route53.md b/Route53/latest/DeveloperGuide/security-iam-awsmanpol-route53.md index caed5d5aa..c77b5e254 100644 --- a//Route53/latest/DeveloperGuide/security-iam-awsmanpol-route53.md +++ b//Route53/latest/DeveloperGuide/security-iam-awsmanpol-route53.md @@ -44,0 +45,18 @@ This permission isn't required if you aren't using the Route 53 console. Route 5 + * `cloudfront:GetDistributionTenantByDomain` – Used to fetch the CloudFront multi-tenant distributions to let you create and update alias records for which the value of **Alias Target** is a CloudFront distribution tenant. + + * `cloudfront:GetConnectionGroup` – Used to fetch the CloudFront multi-tenant distributions to let you create and update alias records for which the value of **Alias Target** is a CloudFront distribution tenant. + + * `cloudwatch:DescribeAlarms` – Together with `sns:ListTopics` and `sns:ListSubscriptionsByTopic`, lets you create, delete, and view CloudWatch alarms. + + * `cloudwatch:GetMetricStatistics` – Lets you create CloudWatch metric health checks. + +These permissions aren't required if you aren't using the Route 53 console. Route 53 uses it only to get statistics to display in the console. + + * `cloudwatch:GetMetricData` – Lets you display the status of your CloudWatch health check metrics. + + * `ec2:DescribeVpcs` – Lets you display a list of VPCs. + + * `ec2:DescribeVpcEndpoints` – Lets you display a list of VPC endpoints. + + * `ec2:DescribeRegions` – Lets you display a list of Availability Zones. + @@ -53 +71 @@ These permissions aren't required if you aren't using the Route 53 console. Rout - * `s3:ListBucket`, `s3:GetBucketLocation`, and `s3:GetBucketWebsite` – Let you create and update alias records for which the value of **Alias Target** is an Amazon S3 bucket. (You can create an alias to an Amazon S3 bucket only if the bucket is configured as a website endpoint; `s3:GetBucketWebsite` gets the required configuration information.) + * `es:ListDomainNames` – Lets you display the names of all Amazon OpenSearch Service domains owned by the current user in the active Region. @@ -55 +73 @@ These permissions aren't required if you aren't using the Route 53 console. Rout -These permissions aren't required if you aren't using the Route 53 console. Route 53 uses these only to get a list of buckets to display in the console. + * `es:DescribeDomains` – Lets you get the domain configuration for the specified Amazon OpenSearch Service domains. @@ -57 +75 @@ These permissions aren't required if you aren't using the Route 53 console. Rout - * `ec2:DescribeVpcs` – Lets you display a list of VPCs. + * `lightsail:GetContainerServices` – Lets you the Lightsail container services to let you create and update alias records for which the value of **Alias Target** is a Lightsail domain. @@ -59 +77 @@ These permissions aren't required if you aren't using the Route 53 console. Rout - * `ec2:DescribeVpcEndpoints` – Lets you display a list of VPC endpoints. + * `s3:ListBucket`, `s3:GetBucketLocation`, and `s3:GetBucketWebsite` – Let you create and update alias records for which the value of **Alias Target** is an Amazon S3 bucket. (You can create an alias to an Amazon S3 bucket only if the bucket is configured as a website endpoint; `s3:GetBucketWebsite` gets the required configuration information.) @@ -61 +79 @@ These permissions aren't required if you aren't using the Route 53 console. Rout - * `ec2:DescribeRegions` – Lets you display a list of Availability Zones. +These permissions aren't required if you aren't using the Route 53 console. Route 53 uses these only to get a list of buckets to display in the console. @@ -65,3 +83 @@ These permissions aren't required if you aren't using the Route 53 console. Rout - * `cloudwatch:GetMetricStatistics` – Lets you create CloudWatch metric health checks. - -These permissions aren't required if you aren't using the Route 53 console. Route 53 uses it only to get statistics to display in the console. + * `tag:GetResources` – Lets you display the tags in your resources. For example, names of your health checks. @@ -71,2 +86,0 @@ These permissions aren't required if you aren't using the Route 53 console. Rout -This permission isn't required if you aren't using the Route 53 console. Route 53 uses it only to get a list of APIs to display in the console. - @@ -87,0 +102,8 @@ For more information about the permissions, see [Amazon Route 53 API permissions + "cloudfront:GetDistributionTenantByDomain", + "cloudfront:GetConnectionGroup", + "cloudwatch:DescribeAlarms", + "cloudwatch:GetMetricStatistics", + "cloudwatch:GetMetricData", + "ec2:DescribeVpcs", + "ec2:DescribeVpcEndpoints", + "ec2:DescribeRegions", @@ -89,0 +112,3 @@ For more information about the permissions, see [Amazon Route 53 API permissions + "es:ListDomainNames", + "es:DescribeDomains", + "lightsail:GetContainerServices", @@ -93,3 +117,0 @@ For more information about the permissions, see [Amazon Route 53 API permissions - "ec2:DescribeVpcs", - "ec2:DescribeVpcEndpoints", - "ec2:DescribeRegions", @@ -98,2 +120 @@ For more information about the permissions, see [Amazon Route 53 API permissions - "cloudwatch:DescribeAlarms", - "cloudwatch:GetMetricStatistics" + "tag:GetResources" @@ -430,0 +452 @@ Change | Description | Date +AmazonRoute53FullAccess – Updated policy | Adds permissions for `cloudwatch:GetMetricData` ,`tag:GetResources`, `es:ListDomainNames`, `es:DescribeDomains`, `cloudfront:GetDistributionTenantByDomain`, `cloudfront:GetConnectionGroup` and `lightsail:GetContainerServices`. These permissions enable you to fetch up to 500 CloudWatch health check metrics, up to 100 names of health checks, get the domain configuration for the specified Amazon OpenSearch Service domains, and list the names of all Amazon OpenSearch Service domains owned by the current user in the active Region, fetch the CloudFront multi-tenant distributions and get the Lightsail container services. | June 01, 2025