Let's Encrypt DNS-01 with Amazon Route 53

When Amazon Route 53 hosts a public zone, lego can create and remove the TXT records required by a Let's Encrypt DNS-01 authorization. That supports ordinary names and wildcard certificates without exposing an HTTP challenge endpoint.

What happens during validation

lego receives an ACME challenge, calculates the expected proof, and calls Route 53 to upsert a TXT value beneath the appropriate _acme-challenge owner. It waits for Route 53 change status and DNS propagation, asks the CA to validate, then removes its temporary value.

The certificate's main private key is generated and stored by lego. Route 53 sees only the temporary validation proof. The AWS credential is still highly sensitive because control of validation records can authorize future certificates.

Specify the hosted zone when the system already knows it

lego can discover a hosted zone by name, but an explicit hosted-zone ID removes discovery ambiguity and can eliminate the need for broad zone-listing authority. It also prevents a similarly named private or public zone from becoming an accidental target.

Use the public zone for public certificate validation. Keep private-zone selection explicit. Verify the domain's registrar delegates to the Route 53 name servers assigned to that zone before troubleshooting the ACME client.

Restrict changes to TXT validation records

A practical least-privilege policy separates global change-status reads, read access to one hosted zone, and conditioned write access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "route53:GetChange",
      "Resource": "arn:aws:route53:::change/*"
    },
    {
      "Effect": "Allow",
      "Action": "route53:ListResourceRecordSets",
      "Resource": "arn:aws:route53:::hostedzone/ZONE_ID"
    },
    {
      "Effect": "Allow",
      "Action": "route53:ChangeResourceRecordSets",
      "Resource": "arn:aws:route53:::hostedzone/ZONE_ID",
      "Condition": {
        "ForAllValues:StringEquals": {
          "route53:ChangeResourceRecordSetsRecordTypes": ["TXT"],
          "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
            "_acme-challenge.example.com"
          ]
        }
      }
    }
  ]
}

Add each exact normalized validation owner required by the certificate. For a wildcard and apex pair, confirm the client uses the expected shared owner. If zone discovery remains enabled, lego may also require route53:ListHostedZonesByName on all resources.

Choose an identity that matches the host

On EC2, an instance role avoids a stored long-lived access key and should be preferred when its metadata path is properly isolated. Outside AWS, use a dedicated IAM identity with only the policy above, or a short-lived session supplied by a separate identity system.

Do not reuse a human administrator key. If static credentials are necessary, store them in a restrictive file owned by the certificate service identity. Disable metadata fallback and implicit profile discovery so a missing credential fails closed instead of selecting a more powerful ambient identity.

Checks before enabling automatic renewal

• Confirm the hosted-zone ID and public delegation.
• List every certificate identifier and its exact challenge owner.
• Test the IAM policy with a harmless TXT lifecycle at only the permitted owner.
• Use Let's Encrypt staging for initial ACME workflow tests.
• Verify lego removes its values without deleting unrelated simultaneous TXT values.
• Enable one daily evaluation after a manual production issuance succeeds.
• Monitor the certificate served by the public endpoint, not only the workspace file.

References

• lego Route 53 provider documentation
• Route 53 identity and access management
• Let's Encrypt DNS-01 challenge
• AcmeMux provider coverage