2026/11/12 - Amazon Route 53 - 3 new api methods
Changes Amazon Route 53 now supports Record Set Protection, which blocks changes to protected records in a hosted zone.
Deletes one or more resource record set protections from a hosted zone. After a protection is deleted, you can change the resource record sets that have that name and type by using ChangeResourceRecordSets.
The request is atomic. Route 53 either deletes all of the protections in the request or none of them. If one or more entries fail, for example because no protection exists for the specified name and type, Route 53 returns an InvalidResourceRecordSetProtectionBatch error that lists the failing entries and the reason that each one failed.
You can specify up to 100 protections in one request.
See also: AWS API Documentation
Request Syntax
client.delete_resource_record_set_protections(
HostedZoneId='string',
Protections=[
{
'RecordName': 'string',
'RecordType': 'SOA'|'A'|'TXT'|'NS'|'CNAME'|'MX'|'NAPTR'|'PTR'|'SRV'|'SPF'|'AAAA'|'CAA'|'DS'|'TLSA'|'SSHFP'|'SVCB'|'HTTPS'
},
]
)
string
[REQUIRED]
The ID of the hosted zone that contains the protections that you want to delete.
list
[REQUIRED]
The name and type of each protection to delete. The list must contain at least one entry and can contain up to 100 entries. Each name and type can appear only once in the list.
(dict) --
The name and type that identify a resource record set protection.
RecordName (string) -- [REQUIRED]
The name of the protected resource record sets.
RecordType (string) -- [REQUIRED]
The DNS record type of the protected resource record sets.
dict
Response Syntax
{}
Response Structure
(dict) --
Lists the resource record set protections in a hosted zone. We recommend using pagination to ensure that the operation returns quickly and successfully.
If the response includes a NextToken element, there are more protections to list. To get the next page of results, submit another request and specify the value of NextToken in the NextToken parameter.
See also: AWS API Documentation
Request Syntax
client.list_resource_record_set_protections(
HostedZoneId='string',
StartRecordName='string',
StartRecordType='SOA'|'A'|'TXT'|'NS'|'CNAME'|'MX'|'NAPTR'|'PTR'|'SRV'|'SPF'|'AAAA'|'CAA'|'DS'|'TLSA'|'SSHFP'|'SVCB'|'HTTPS',
MaxResults='string',
NextToken='string'
)
string
[REQUIRED]
The ID of the hosted zone that contains the protections that you want to list.
string
The first resource record set name that you want Route 53 to list protections for. If you don't specify a value, the list starts with the first protection in the hosted zone.
If you specify NextToken, Route 53 ignores StartRecordName.
string
The first resource record set type, within the name specified by StartRecordName, that you want Route 53 to list protections for. If you specify StartRecordType, you must also specify StartRecordName.
If you specify NextToken, Route 53 ignores StartRecordType.
string
The maximum number of protections that you want Route 53 to return in this response. If you don't specify a value, or if you specify a value greater than 300, Route 53 returns up to 300 protections.
string
If the response to a previous ListResourceRecordSetProtections request included a NextToken element, specify that value here to get the next page of results.
dict
Response Syntax
{
'ResourceRecordSetProtections': [
{
'RecordName': 'string',
'RecordType': 'SOA'|'A'|'TXT'|'NS'|'CNAME'|'MX'|'NAPTR'|'PTR'|'SRV'|'SPF'|'AAAA'|'CAA'|'DS'|'TLSA'|'SSHFP'|'SVCB'|'HTTPS',
'Comment': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ResourceRecordSetProtections (list) --
The protections in the hosted zone. The list is empty if the hosted zone has no protections.
(dict) --
A protection for the resource record sets in a hosted zone that have the specified name and type. While the protection exists, Route 53 rejects ChangeResourceRecordSets requests that create, update, or delete those resource record sets.
RecordName (string) --
The name of the protected resource record sets.
RecordType (string) --
The DNS record type of the protected resource record sets.
Comment (string) --
The comment that was specified when the protection was created, if any.
NextToken (string) --
If there are more protections to list, a token that you can specify in the NextToken parameter of another request to get the next page of results. If there are no more protections to list, the response doesn't include NextToken.
Creates one or more resource record set protections in a hosted zone. A protection applies to every resource record set in the hosted zone that has the specified name and type. While a protection exists, Route 53 rejects any ChangeResourceRecordSets request that creates, updates, or deletes a resource record set with that name and type, and returns an InvalidChangeBatch error. To change a protected resource record set, first delete its protection by using DeleteResourceRecordSetProtections.
You can create a protection for a name and type that doesn't have a resource record set yet. In that case, Route 53 also rejects requests to create that resource record set.
You can't delete a hosted zone that has protections. To delete the hosted zone, first delete all of its protections by using DeleteResourceRecordSetProtections.
The request is atomic. Route 53 either creates all of the protections in the request or none of them. If one or more entries fail, the response is an error that lists the failing entries and the reason that each one failed. Route 53 checks for invalid entries before it checks for existing protections, so if any entry is invalid, the error lists only the invalid entries.
The error that Route 53 returns depends on the failures:
If every entry already has a protection, Route 53 returns a ProtectionAlreadyExists error.
For any other combination of failures, Route 53 returns an InvalidResourceRecordSetProtectionBatch error.
You can specify up to 100 protections in one request. The number of protections that you can have in a hosted zone is limited by a quota. If the request would exceed that quota, Route 53 returns a LimitsExceeded error.
See also: AWS API Documentation
Request Syntax
client.create_resource_record_set_protections(
HostedZoneId='string',
Protections=[
{
'RecordName': 'string',
'RecordType': 'SOA'|'A'|'TXT'|'NS'|'CNAME'|'MX'|'NAPTR'|'PTR'|'SRV'|'SPF'|'AAAA'|'CAA'|'DS'|'TLSA'|'SSHFP'|'SVCB'|'HTTPS',
'Comment': 'string'
},
]
)
string
[REQUIRED]
The ID of the hosted zone that contains the resource record sets that you want to protect.
list
[REQUIRED]
The protections to create. Each entry specifies a resource record set name and type, and an optional comment. The list must contain at least one entry and can contain up to 100 entries. Each name and type can appear only once in the list.
(dict) --
A protection to create for the resource record sets in a hosted zone that have the specified name and type.
RecordName (string) -- [REQUIRED]
The name of the resource record sets to protect, for example, www.example.com. The name must be the name of the hosted zone or a subdomain of it.
RecordType (string) -- [REQUIRED]
The DNS record type of the resource record sets to protect. You can't protect records of type DNAME or of the DNSSEC record types that Route 53 manages.
Comment (string) --
An optional comment about the protection, for example, the reason that the resource record sets are protected. The comment can be up to 256 characters long. If you don't specify a comment, the protection doesn't have a comment. When Route 53 rejects a ChangeResourceRecordSets request because of this protection, the error message includes the comment, so don't include sensitive information.
dict
Response Syntax
{}
Response Structure
(dict) --