IAM User - cloudformation - route53

route53.yaml

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  Password:
    NoEcho: 'true'
    Type: String
    Description: New account password
    MinLength: '1'
    MaxLength: '41'
    ConstraintDescription: the password must be between 1 and 41 characters

Resources:
  Route53User:
    Type: AWS::IAM::User
    Properties:
      LoginProfile:
        Password: !Ref 'Password'
  Route53AdminGroup:
    Type: AWS::IAM::Group
  Admins:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName: !Ref 'Route53AdminGroup'
      Users: [!Ref 'Route53User']
  Route53ChangePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: Route53Change
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action: 'route53:ChangeResourceRecordSets'
          Resource: 'arn:aws:route53:::hostedzone/*'
      Groups: [!Ref 'Route53AdminGroup']
  Route53ListPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: Route53List
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action: ['route53:ListHostedZones', 'route53:ListResourceRecordSets']
          Resource: '*'
      Groups: [!Ref 'Route53AdminGroup']
  Route53Keys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref 'Route53User'

Outputs:
  AccessKey:
    Value: !Ref 'Route53Keys'
    Description: AWSAccessKeyId of new user
  SecretKey:
    Value: !GetAtt [Route53Keys, SecretAccessKey]
    Description: AWSSecretAccessKey of new user