Can you perform audits on Route53 to see what was changed in the DNS records? Can you block access to route53 using IAM? I ask this because it wasn't possible a year ago.
Yes, you can provide an IAM policy that excludes Route53.
No, I'm not aware of any built-in auditing. You could, though, set something up via the APIs to periodically export your records and audit changes on your end.