Our application submits AWS Route 53 record set changes so that we can create new subdomains programmatically. Up until this point, everything has been hosted in the US-West (Oregon) region, and is working fine. We recently created a new cluster in the AWS Singapore region, but unfortunately we are receiving access-denied messages when attempting to create new Route 53 record sets from this Singapore cluster. The code is identical, the only difference is that we are now running in Singapore instead of Oregon.
User: arn:aws:iam::1234512345:user/some_user_name is not authorized to access this resource (Service: AmazonRoute53; Status Code: 403; Error Code: AccessDenied...
The associated IAM user has full permissions (we're still in DEV) when viewing his account in the AWS IAM Console. Something akin to this if I recall:
"Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]
Are there higher level restrictions in place on users concerning regions? Do I need to create a new user somehow associated with Singapore so that account can process our Route 53 requests? Does the fact that the user's resource identifier is missing a region indicate something (arn:aws:iam:?????:1234512345:user/some_user_name)?