Create an authorised integration identity under your AWS access policy. Restrict permissions to the required hosted-zone discovery, record reads and changes, and zone lifecycle operations where needed. Some discovery actions have different resource-scoping rules from record changes, so construct the policy from AWS's action reference instead of assuming one hosted-zone ARN covers every call.

The current connection form accepts the access key and secret pair. Do not paste an expiring session token into either field or assume that an unrelated AWS console login will work. Record credential ownership and a planned rotation date.

1. In Domain Nexus Servers, choose AWS Route53.
2. Enter Access Key ID and Secret Access Key.
3. Leave the optional DNSSEC fields for a separate signing setup unless you have already prepared the required KMS key.
4. Save and check the connection. Select an owned public hosted zone for a read and a temporary TXT record change.
5. For packages that create zones, verify one controlled new-zone workflow and record the nameservers Route 53 assigns to that hosted zone.

• Prepare Route 53 KMS permissions before enabling DNSSEC
• Operate DNSSEC from zone signing through parent DS verification
• Run a controlled DNS provider acceptance check before assigning customer packages
• Rotate a DNS provider credential across all connections that use it
• Connect bunny.net DNS and configure an optional vanity nameserver pair

• AWS: Managing access to Route 53
• AWS: Route 53 service authorisation actions