# Amazon Route 53


<!-- Code generated by gen-dns-providers; DO NOT EDIT. -->

Configuration for the [Amazon Route 53](https://aws.amazon.com/route53/) DNS provider.

See the [lego documentation](https://go-acme.github.io/lego/dns/route53/) for full details.

```yaml
letsEncrypt:
  dnsProvider: "route53"
  dnsCredentials:
    # AWS_ACCESS_KEY_ID: Managed by the AWS client. Access key ID (`AWS_ACCESS_KEY_ID_FILE` is not supported, use `AWS_SHARED_CREDENTIALS_FILE` instead)
    accessKeyID: ""
    # AWS_ASSUME_ROLE_ARN: Managed by the AWS Role ARN (`AWS_ASSUME_ROLE_ARN_FILE` is not supported)
    assumeRoleARN: ""
    # AWS_EXTERNAL_ID: Managed by STS AssumeRole API operation (`AWS_EXTERNAL_ID_FILE` is not supported)
    externalID: ""
    # AWS_HOSTED_ZONE_ID: Override the hosted zone ID.
    hostedZoneID: ""
    # AWS_REGION: Managed by the AWS client (`AWS_REGION_FILE` is not supported)
    region: ""
    # AWS_SECRET_ACCESS_KEY: Managed by the AWS client. Secret access key (`AWS_SECRET_ACCESS_KEY_FILE` is not supported, use `AWS_SHARED_CREDENTIALS_FILE` instead)
    secretAccessKey: ""
    # AWS_WAIT_FOR_RECORD_SETS_CHANGED: Wait for changes to be INSYNC (it can be unstable)
    waitForRecordSetsChanged: ""
    # AWS_MAX_RETRIES: The number of maximum returns the service will use to make an individual API request
    maxRetries: ""
    # AWS_POLLING_INTERVAL: Time between DNS propagation check in seconds (Default: 4)
    pollingInterval: ""
    # AWS_PRIVATE_ZONE: Set to true to use private zones only (default: use public zones only)
    privateZone: ""
    # AWS_PROPAGATION_TIMEOUT: Maximum waiting time for DNS propagation in seconds (Default: 120)
    propagationTimeout: ""
    # AWS_TTL: The TTL of the TXT record used for the DNS challenge in seconds (Default: 10)
    ttl: ""
```

Credentials are passed directly to lego using strong types and are never written to the process environment.
You may also use the raw lego environment-variable names as keys instead of the normalized names.

AWS credentials can be provided as the `accessKeyID`/`secretAccessKey` keys above.
Alternatively, the AWS SDK's own credential sources are honored, including the
`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` environment variables, a shared
credentials file (`AWS_SHARED_CREDENTIALS_FILE`), an assumed role, or an EC2/ECS
instance role. These are read directly by the AWS SDK and are not managed by
le-cert-server.