AWS Route53

Overview

Amazon Route53 is AWS's DNS web service. DNS Watchdog connects via a cross-account IAM role to discover hosted zones and sync records. This approach avoids long-lived access keys and follows AWS security best practices.

Prerequisites

You'll need the following to connect Route53 to DNS Watchdog:

Field	Description
Role ARN	The ARN of the IAM role created in your AWS account
External ID	Auto-generated by DNS Watchdog to prevent confused deputy attacks

The External ID is provided by DNS Watchdog when you start the provider setup — you'll use it when creating the IAM role trust policy.

External ID

The External ID is automatically generated by DNS Watchdog. To get it:

In DNS Watchdog, go to Settings → Providers → Add Provider
Select AWS Route53 as the provider type
The wizard will display your unique External ID

Keep this value handy — you'll need it when creating the trust policy for your IAM role.

Creating an IAM Policy (Permissions)

Before creating the role, you need a policy that defines what DNS Watchdog can access.

In the AWS Console, go to IAM → Policies → Create policy
Select the JSON tab
Paste one of the policies below (depending on your access needs)
Click Next, name it something like DNSWatchdogRoute53Access
Click Create policy

Save the policy JSON to a file (e.g. permission-policy.json), then run:

aws iam create-policy \
  --policy-name DNSWatchdogRoute53Access \
  --policy-document file://permission-policy.json

Note the Policy ARN from the output — you'll need it when attaching the policy to the role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListResourceRecordSets",
        "route53:GetHostedZone",
        "route53:ListTagsForResource"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListResourceRecordSets",
        "route53:GetHostedZone",
        "route53:ListTagsForResource",
        "route53:ChangeResourceRecordSets"
      ],
      "Resource": "*"
    }
  ]
}

Creating an IAM Role (Role ARN)

The IAM role allows DNS Watchdog to access your account using cross-account role assumption. The trust policy includes your External ID to prevent confused deputy attacks.

In the AWS Console, go to IAM → Roles → Create role
Select Custom trust policy as the trusted entity type
Paste the trust policy JSON below, replacing <YOUR_EXTERNAL_ID> with the value from the DNS Watchdog wizard
Click Next
Search for and attach the DNSWatchdogRoute53Access policy you created earlier
Click Next, name the role (e.g. DNSWatchdogRoute53Role)
Click Create role
Open the role and copy the Role ARN from the top of the page — you'll enter this in DNS Watchdog

Save the trust policy JSON below to a file (e.g. trust-policy.json), replacing the placeholders, then run:

# Create the role with the custom trust policy
aws iam create-role \
  --role-name DNSWatchdogRoute53Role \
  --assume-role-policy-document file://trust-policy.json

# Attach the permission policy to the role
aws iam attach-role-policy \
  --role-name DNSWatchdogRoute53Role \
  --policy-arn arn:aws:iam::<YOUR_ACCOUNT_ID>:policy/DNSWatchdogRoute53Access

The Role ARN is in the output of the create-role command. To look it up later:

aws iam get-role --role-name DNSWatchdogRoute53Role --query "Role.Arn" --output text

The trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::241415060835:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}

Adding the Provider in DNS Watchdog

Go to Settings → Providers → Add Provider
Select AWS Route53 as the provider type
Enter a name for the provider (e.g. "Production Route53")
Choose whether the provider should be Read-Only or Read-Write
Paste the Role ARN from the IAM role you created
Click Test & Save to verify the connection

DNS Watchdog will assume the role and confirm it can access your hosted zones.

Permissions

Read-only — use the read-only policy (list and get operations only)
Read-write — use the read-write policy (adds ChangeResourceRecordSets for record management)