upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-02-18 18:17:52 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Granular permissions (#9922)

Browse source 
Set granular permissions to TXT DNS records with names starting with
`_acme-challenge.` only
This replaces original policy that is too permissive

The `Condition` clause uses [Route 53 resource record set
permission](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-permissions.html)

Policy tested with Certbot 2.9.0
This commit is contained in:
Mike Lim 2026-02-03 03:18:05 +08:00 committed by GitHub
parent 991ecd7c8e
commit 88af129315
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
certbot-dns-route53/examples/sample-aws-policy.json
View file

@ -19,7 +19,19 @@
],
"Resource" : [
"arn:aws:route53:::hostedzone/YOURHOSTEDZONEID"
]
],
"Condition": {
"ForAllValues:StringLike": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"_acme-challenge.*"
]
},
"ForAllValues:StringEquals": {
"route53:ChangeResourceRecordSetsRecordTypes": [
"TXT"
]
}
}
}
]
}