ROUTE53: Document Minimum access  policy learned from
@@ -61,7 +61,31 @@ D('example.tld', REG_NONE, DnsProvider(R53),
{% endhighlight %}
## Activation
-DNSControl depends on a standard [AWS access key](https://aws.amazon.com/developers/access-keys/) with permission to list, create and update hosted zones.
+DNSControl depends on a standard [AWS access key](https://aws.amazon.com/developers/access-keys/) with permission to list, create and update hosted zones. If you do not have the permissions required you will receive the following error message `Check your credentials, your not authorized to perform actions on Route 53 AWS Service`.
+
+You can apply the `AmazonRoute53FullAccess` policy however this includes access to many other areas of AWS. The minimum permissions required are as follows:
+
+{% highlight json %}
+{
+ "Version": "2012-10-17",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "route53:CreateHostedZone",
+ "route53:GetHostedZone",
+ "route53:ListHostedZones",
+ "route53:ChangeResourceRecordSets",
+ "route53:ListResourceRecordSets",
+ "route53:UpdateHostedZoneComment"
+ ],
+ "Resource": "*"
+ }
+ ]
+}
+{% endhighlight %}
+
+If Route53 is also your registrar, you will need `route53domains:UpdateDomainNameservers` and `route53domains:GetDomainDetail` as well and possibly others.
## New domains
If a domain does not exist in your Route53 account, DNSControl will *not* automatically add it with the `push` command. You can do that either manually via the control panel, or via the command `dnscontrol create-domains` command.
@@ -139,3 +163,13 @@ Creating r53_main dns provider: SignatureDoesNotMatch: The request signature we
```
This means the SecretKey is incorrect. It may be a quoting issue.
+
+### Incomplete Signature
+
+```
+$ ./dnscontrol preview
+IncompleteSignature: 'ABCDEFGHIJKLMNOPQRST/20200118/us-east-1/route53/aws4_request' not a valid key=value pair (missing equal-sign) in Authorization header: 'AWS4-HMAC-SHA256 Credential= ABCDEFGHIJKLMNOPQRST/20200118/us-east-1/route53/aws4_request, SignedHeaders=host;x-amz-date, Signature=571c0b13205669a338f0fb9f351dc03c7016c8737c738081bc885c68378ad877'.
+ status code: 403, request id: 12a34b5c-d678-9e01-f2gh-3456i7jk89lm
+```
+
+This means a space is present in one or more of the credential values.
