Granting Us Access on Amazon Route 53
This page is for clients whose DNS lives in Amazon Web Services. You'll create a narrowly-scoped IAM policy — from JSON we supply — that lets McNair Media update the records that point your website at our infrastructure during an outage. Your AWS account, your billing, and every other resource stay entirely out of reach.
1 — We Send You a Policy
We provide a small IAM policy document, pre-filled with your hosted zone's ID. You (or your IT team) paste it into IAM → Policies → Create policy → JSON. Nothing in it is mysterious — it grants record changes on your zone and nothing else, and we're happy to walk through it line by line.
2 — Attach It to a Role for Us
Create an IAM role that trusts our AWS account (we supply the account ID), attach the policy, and send us the role's ARN. No passwords or keys change hands at all — AWS's own cross-account mechanism handles the trust.
3 — The Strictest Option Anywhere
Route 53 is the one DNS service that can technically restrict us to specific records — the policy can say "the A record for yourdomain.com and www, and nothing else." If you want a grant where touching your mail records is impossible rather than just promised, this is it.
Narrow on Purpose
- It allows: updating the DNS records that route your web traffic, in one hosted zone — which is what automatic outage failover needs
- It cannot: see or touch any other AWS resource, service, or bill — and with the record-level option, it cannot touch your mail records even in principle
- Every change is on the record: logged on our side, and independently in your AWS CloudTrail
- To revoke: delete the role (or detach the policy) in IAM. Our access ends immediately