Connect AWS Route 53

RedundantDNS talks to Route 53 with an IAM access key that you create in your AWS account. The key is encrypted with your organization's key as soon as it reaches us, is never shown again, and is only used to read and write the DNS zones you attach.

Pick the access level that matches how much you want to delegate:

Access level	What RedundantDNS can do
Create and manage zones	Create hosted zones, write their records and apex NS, and delete a zone when you detach it (only after you type the zone name).
Manage an existing zone	Read and edit the records of one hosted zone that you created. It never creates or deletes zones.

Create and manage zones

In the AWS console, open IAM → Users → Create user. Name it, for example, redundantdns. It does not need console access.
Attach this inline policy (Add permissions → Create inline policy → JSON):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RedundantDnsManageZones",
      "Effect": "Allow",
      "Action": [
        "route53:CreateHostedZone",
        "route53:DeleteHostedZone",
        "route53:ListHostedZones",
        "route53:ListHostedZonesByName",
        "route53:GetHostedZone",
        "route53:GetChange",
        "route53:ListResourceRecordSets",
        "route53:ChangeResourceRecordSets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RedundantDnsQueryMetricsOptional",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    }
  ]
}

The second statement is optional: it only lets RedundantDNS read the query counts Route 53 publishes to CloudWatch (used for managed-mode billing and usage charts). Remove it if you do not need them.

Open the user, go to Security credentials → Create access key, choose Application running outside AWS, and copy the Access key ID and Secret access key.
In RedundantDNS, Providers → Add connection: provider AWS Route 53, access level Create and manage zones, paste both keys and click Test and save. We check the key by listing your hosted zones.

Manage an existing zone

Use this when you already created the hosted zone yourself and want to grant access to that zone only.

Copy the hosted zone ID from Route 53 → Hosted zones (it looks like Z0123456789ABCDEFGHIJ).
Create an IAM user as above and attach this inline policy, replacing <HOSTED_ZONE_ID>:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RedundantDnsEditOneZone",
      "Effect": "Allow",
      "Action": [
        "route53:GetHostedZone",
        "route53:ListResourceRecordSets",
        "route53:ChangeResourceRecordSets"
      ],
      "Resource": "arn:aws:route53:::hostedzone/<HOSTED_ZONE_ID>"
    },
    {
      "Sid": "RedundantDnsChangeStatus",
      "Effect": "Allow",
      "Action": "route53:GetChange",
      "Resource": "arn:aws:route53:::change/*"
    }
  ]
}

route53:ListHostedZones is not required: RedundantDNS never lists your account. (GetChange is scoped to change ARNs because that is the resource type IAM uses for it; it only reveals the status of a change.)

Create the access key as above and add the connection with access level Manage an existing zone. The key is checked when you attach it to a zone: open the zone, Providers → Attach, pick the connection and paste the hosted zone ID. We verify that the hosted zone holds the same domain and that the key can read its records.

Region

Route 53 is a global service; the region field can stay us-east-1 (the region where Route 53 publishes its CloudWatch metrics).

What RedundantDNS writes

Every record set you manage in the dashboard.
The apex NS record set: RedundantDNS rewrites it to list the nameservers of every attached provider, so each copy of the zone delegates to all of them. It is shown read-only in the dashboard.
It never touches the SOA record, alias records or routing policies (weighted, latency, geolocation...), which are Route 53-only features.

Revoking access

Delete the access key (or the IAM user) in IAM at any time. Then remove the connection in Providers; zones keep being served by Route 53 exactly as they are.