Fine-grained Amazon Route 53 access with IAM condition keys (Part 3)

This article demonstrates how to implement fine-grained Route 53 access for federated users in AWS IAM Identity Center using session tags derived from user attributes.

• Use IAM Identity Center session tags with user attributes to control DNS record access without individual policies
• Map user attributes to ABAC attributes in IAM Identity Center for dynamic permission evaluation
• Create permission sets with conditional policies using route53:ChangeResourceRecordSetsNormalizedRecordNames
• Federated users can manage only DNS records matching their assigned attribute values in shared hosted zones
• Automatically adapts permissions when user attributes change without policy updates

This approach eliminates the need for per-user policies while maintaining least-privilege access for federated users managing shared Route 53 hosted zones.