<p>I have installed external-dns using bitnami helm chart with version 6.10.2.
I have created IAM policy to give permissions to list Route53 hosted zones.</p>
<p>IAM policy</p>
<pre><code>{
    &quot;Statement&quot;: [
        {
            &quot;Action&quot;: [
                &quot;route53:ListHostedZones&quot;,
                &quot;route53:ListResourceRecordSets&quot;
            ],
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Resource&quot;: [
                &quot;*&quot;
            ]
        },
        {
            &quot;Action&quot;: [
                &quot;route53:ChangeResourceRecordSets&quot;
            ],
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Resource&quot;: [
                &quot;*&quot;
            ]
        }
    ],
    &quot;Version&quot;: &quot;2012-10-17&quot;
}
</code></pre>
<p>IAM policy is also mapped to serviceaccount</p>
<pre><code>eksctl get iamserviceaccount --cluster=testcluster --namespace add-ons
NAMESPACE   NAME        ROLE ARN
add-ons     external-dns    arn:aws:iam::442355839237:role/eksctl-testcluster-addon-iamserviceaccount-ad-Role1-6AV1JQ2NPCMO
</code></pre>
<p>OIDC is already enabled</p>
<pre><code>eksctl utils associate-iam-oidc-provider --cluster=testcluster
2022-10-17 14:31:13 [ℹ]  IAM Open ID Connect provider is already associated with cluster &quot;testcluster&quot; in &quot;us-west-2&quot;
</code></pre>
<p>However I still see the error in external-dns pod that it is unable to list the hosted zones.</p>
<pre><code>7T21:24:03Z&quot; level=error msg=&quot;records retrieval failed: failed to list hosted zones: AccessDenied: User: arn:aws:sts::442355839237:assumed-role/workers-eks-node-group-20221013233723853600000005/i-0a1b8a914bcff1436 is not authorized to perform: route53:ListHostedZones because no identity-based policy allows the route53:ListHostedZones action\n\tstatus code: 403, request id: a8f86d66-d7af-4bd0-975c-6f99d1134d50&quot;
</code></pre>
<p>Strangely..it is also showing &quot;User: arn:aws:sts::442355839237:assumed-role/workers-eks-node-group-20221013233723853600000005/i-0a1b8a914bcff1436&quot; workers-eks-node-group in the role name instead of the role arn:aws:iam::442355839237:role/eksctl-testcluster-addon-iamserviceaccount-ad-Role1-6AV1JQ2NPCMO which maps the service account with Route53 permissions.</p>
<p>Any pointers on why it is failing?arn:aws:iam::442355839237:role/eksctl-testcluster-addon-iamserviceaccount-ad-Role1-6AV1JQ2NPCMO</p>

Rad4
<p>I have fixed this..
changeresourcerecordsets need to be specific with arns of hosted zones instead of &quot;*&quot;</p>
<p><a href="https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#iam-policy" rel="nofollow noreferrer">https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/aws.md#iam-policy</a></p>
<pre><code>data &quot;aws_iam_policy_document&quot; &quot;external_dns&quot; {
count = var.create_role &amp;&amp; var.attach_external_dns_policy ? 1 : 0
statement {
actions = [&quot;route53:ChangeResourceRecordSets&quot;]
resources = var.external_dns_hosted_zone_arns
}
statement {
actions = [
&quot;route53:ListHostedZones&quot;,
&quot;route53:ListResourceRecordSets&quot;,
]
resources = [&quot;*&quot;]
}
}

    
</code></pre>
