1

Our application submits AWS Route 53 record set changes so that we can create new subdomains programmatically. Up until this point, everything has been hosted in the US-West (Oregon) region, and is working fine. We recently created a new cluster in the AWS Singapore region, but unfortunately we are receiving access-denied messages when attempting to create new Route 53 record sets from this Singapore cluster. The code is identical, the only difference is that we are now running in Singapore instead of Oregon.

User: arn:aws:iam::1234512345:user/some_user_name is not authorized to access this resource (Service: AmazonRoute53; Status Code: 403; Error Code: AccessDenied...

The associated IAM user has full permissions (we're still in DEV) when viewing his account in the AWS IAM Console. Something akin to this if I recall:

"Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]

Are there higher level restrictions in place on users concerning regions? Do I need to create a new user somehow associated with Singapore so that account can process our Route 53 requests? Does the fact that the user's resource identifier is missing a region indicate something (arn:aws:iam:?????:1234512345:user/some_user_name)?

1

Turns out I did not have the appropriate security groups on my new Singapore Load Balancer that was being associated with the new Route53 record. I associated a generic 'AWS-LB' security group with the load balancer (instead of the VPC security group which was selected by default) and I no longer get the error.

  • You should then accept your own answer. – asymmetric Apr 10 '17 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.