I would like to programmatically change the CNAME of a Record Set inside an Hosted Zone on Amazon Route 53, but I would like to restrict the access of the user ONLY to that record set. For what I have seen on the documentation IAM allow to specify operation only based on "hosted-zone" or "changes". This means that my user need to have power over ALL my record set to change a single one.
The consequences of an error in the code in a case like this are more than catastrophic. If the checks on the hosted zone name are wrong, for any reason, I could for error apply the changes to more than one record set (imagine many Record Set pointing now on the same box/infrastructure).
My question is not about not making errors in the code, but about creating a user to protect the system from such possibilities. There is a way to restrict access (or a workaround) to allow a new IAM user to access one/a limited set of Hosted Zones only.
On IAM level, not programmatically.