I have access to two AWS accounts, training and staging. Staging account holds all hosted zones, IAM roles; I want to grant access to training account so it can access a resource in Route53. I have created an IAM policy as below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/*"
]
},
{
"Effect": "Allow",
"Action": [
"route53:ListHostedZones",
"route53:ListResourceRecordSets"
],
"Resource": [
"*"
]
}
]
}
Then I created an IAM role and attached above policy using "Another AWS account" option inserting training account ID, but I am still not able to list any hosted zones.
I am not sure what exactly I am missing here.