I'm using Amazon Route 53 to host several domains, and I need to grant permission to several of those domains to several users.
How can I do this process from the command line?
I am not sure if IAM allows for delegation of access to specific zone files within Route53 or not. If it were, I imagine it would boil down to these steps:
About the policy
Here is the default "full admin" template for Route53 permissions within IAM:
You'll see here that IAM is granting permissions to two things in this policy -- Route53 and ELBs. ELBs are needed by some Route53 users if they are pointing a zone apex as an alias to an ELB address (see http://aws.amazon.com/route53/faqs/#Zone_apex). I would suggest you leave that part unless you know your user will not need that and if it tests fine. This policy only allows the user to list the ELBs and not control them, so it seems the worst risk is that they point their domain to one of your ELBs, which you may at some point want or need.
The * in the allowed actions for Route53 will let your user create, edit, or delete record sets within the zone file that you grant them permissions to.
So the only part that needs editing is the * within the
So your policy would end up looking something like this:
However, looking back on your question, you ask how to do this from the CLI. I'm not sure if you mean perform all the delegation from the CLI or have the user do their DNS work from the CLI? If it's the former, you can control IAM through its API, including specifying the security policy for the group you create.
Here is the IAM tool for the API: http://aws.amazon.com/developertools/AWS-Identity-and-Access-Management/4143
Here are the many calls you can make to that API: http://aws.amazon.com/iam/#detailed_description
Here is a pile of other IAM resources: http://aws.amazon.com/iam/#resources
If the IAM policy needs tweaking, this might be very useful: http://awspolicygen.s3.amazonaws.com/policygen.html
If I get some free time I may try testing this myself and see if it's all clear. I've seen other services where IAM thought it was delegating properly but some user permissions still didn't work perfectly. I'll be interested to see if this is the case in Route53 or not.