Connect a Amazon Route 53 domain

Setup type: Automatic (API token). You paste a scoped Amazon Route 53 API token once and the app writes the records for you; nothing to copy by hand.

Amazon Route 53 connects with an API credential and CustomDomain writes the records for you, no copy-paste. Route 53 is AWS's DNS service, so the connection uses an AWS credential scoped to the hosted zone.

What you'll need

• A domain whose DNS is managed at Amazon Route 53.
• Access to your app's CustomDomain dashboard (it shows the exact target for your account).
• A scoped Amazon Route 53 API token (see below).

The records

CustomDomain gives you the authoritative records for your account in the dashboard, typically a CNAME (or apex A/ALIAS) pointing your domain at the edge. Use the values shown there; the shape is always the same, the target is per-account. There is no separate ownership TXT to add on this path: control is proven by the rail itself, or by the records appearing in your own authoritative DNS. See Setup types.

Setting it up on Amazon Route 53

1. Create a scoped DNS token in the Amazon Route 53 dashboard (open it).
2. Paste it into the connect widget.
3. CustomDomain writes the records for you and verifies them.

Amazon Route 53 specifics

• There's a root-account-vs-IAM distinction on AWS; use an IAM credential scoped to Route 53 rather than root keys.
• Root-vs-IAM sub-flow when credential login ships (Mode D).

How you know it worked

CustomDomain polls public DNS and issues the TLS certificate automatically. When the dashboard shows the domain live, HTTPS is serving. Drift monitoring then watches the records so a later change at the provider doesn't silently break the domain.

FAQ

What AWS permissions does this need?

Permission to change resource record sets in the specific Route 53 hosted zone for your domain, not broad AWS access. Scope an IAM policy to that zone.

Related

• All DNS providers, the full connection catalog.
• How custom domains work