Amazon Route 53

Configuration for the Amazon Route 53 DNS provider.

See the lego documentation for full details.

letsEncrypt:
  dnsProvider: "route53"
  dnsCredentials:
    # AWS_ACCESS_KEY_ID: Managed by the AWS client. Access key ID (`AWS_ACCESS_KEY_ID_FILE` is not supported, use `AWS_SHARED_CREDENTIALS_FILE` instead)
    accessKeyID: ""
    # AWS_ASSUME_ROLE_ARN: Managed by the AWS Role ARN (`AWS_ASSUME_ROLE_ARN_FILE` is not supported)
    assumeRoleARN: ""
    # AWS_EXTERNAL_ID: Managed by STS AssumeRole API operation (`AWS_EXTERNAL_ID_FILE` is not supported)
    externalID: ""
    # AWS_HOSTED_ZONE_ID: Override the hosted zone ID.
    hostedZoneID: ""
    # AWS_REGION: Managed by the AWS client (`AWS_REGION_FILE` is not supported)
    region: ""
    # AWS_SECRET_ACCESS_KEY: Managed by the AWS client. Secret access key (`AWS_SECRET_ACCESS_KEY_FILE` is not supported, use `AWS_SHARED_CREDENTIALS_FILE` instead)
    secretAccessKey: ""
    # AWS_WAIT_FOR_RECORD_SETS_CHANGED: Wait for changes to be INSYNC (it can be unstable)
    waitForRecordSetsChanged: ""
    # AWS_MAX_RETRIES: The number of maximum returns the service will use to make an individual API request
    maxRetries: ""
    # AWS_POLLING_INTERVAL: Time between DNS propagation check in seconds (Default: 4)
    pollingInterval: ""
    # AWS_PRIVATE_ZONE: Set to true to use private zones only (default: use public zones only)
    privateZone: ""
    # AWS_PROPAGATION_TIMEOUT: Maximum waiting time for DNS propagation in seconds (Default: 120)
    propagationTimeout: ""
    # AWS_TTL: The TTL of the TXT record used for the DNS challenge in seconds (Default: 10)
    ttl: ""

Credentials are passed directly to lego using strong types and are never written to the process environment. You may also use the raw lego environment-variable names as keys instead of the normalized names.

AWS credentials can be provided as the accessKeyID/secretAccessKey keys above. Alternatively, the AWS SDK’s own credential sources are honored, including the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY environment variables, a shared credentials file (AWS_SHARED_CREDENTIALS_FILE), an assumed role, or an EC2/ECS instance role. These are read directly by the AWS SDK and are not managed by le-cert-server.

Edit this page on GitHub