title: AWS Lightsail can't update Route53 for Let'sEncrypt certs
body: <p>I'm trying to get Let's Encrypt automatic cert update on a AWS Lightsail wordpress instance and Route53.</p>
  <p>I used <a href="https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress" rel="nofollow noreferrer">these official instructions</a> for adding a SSL certs to a AWS Lightsail wordpress website.</p>
  <p>Site SSL is working fine, but I was looking for a way to automate the re-issue and found the certbot plugin - <a href="https://certbot-dns-route53.readthedocs.io/en/stable/" rel="nofollow noreferrer">certbot-dns-route53</a></p>
  <p>I created a separate AWS non-admin user just for the updates, and added the policy as suggested by the certbot official docs</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;certbot-dns-route53 sample policy&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;route53:ListHostedZones&quot;,
                  &quot;route53:GetChange&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;*&quot;
              ]
          },
          {
              &quot;Effect&quot; : &quot;Allow&quot;,
              &quot;Action&quot; : [
                  &quot;route53:ChangeResourceRecordSets&quot;
              ],
              &quot;Resource&quot; : [
                  &quot;arn:aws:route53:::hostedzone/MYZONEID&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>I placed the API access information in both a environment variable and ~/.aws.config file.</p>
  <p>I executed the command -</p>
  <pre><code>    sudo certbot certonly --dns-route53 --dns-route53-propagation-seconds 30 --dry-run -d 'domain.
  com,*.domain.com'
  </code></pre>
  <p>And I get the following error -</p>
  <blockquote>
  <p>An error occurred (AccessDenied) when calling the ListHostedZones
  operation: User: arn:aws:sts::548507530525:assumed-role/Amaz
  onLightsailInstanceRole/i-00ff79ff762ac0576 is not authorized to
  perform: route53:ListHostedZones To use certbot-dns-route53, configure
  credentials as described at
  <a href="https://boto3.readthedocs.io/en/latest/guide/configuration.h" rel="nofollow noreferrer">https://boto3.readthedocs.io/en/latest/guide/configuration.h</a>
  tml#best-practices-for-configuring-credentials and add the necessary
  permissions for Route53 access</p>
  </blockquote>
  <p>I attempted a ~.aws/config &amp; credentials file as well  -</p>
  <p>config-</p>
  <pre><code>[profile cross-account]
  role_arn=arn:aws:iam::XXXXXXXXXXX:user/domain_cert_update
  source_profile=default
  </code></pre>
  <p>credentials -</p>
  <pre><code>[default]
  aws_access_key_id=ACCESSKEY
  aws_secret_access_key=SECRETKEYHERE
  </code></pre>
  <p>I'm not sure how to get the lightsail instance of /i-00ff79ff762ac0576 assigned to the policy correctly.  I've read through the config guide it links and it doesn't help.</p>