cli53

cli53 supports importing and exporting records using the BIND format.

Importing

• Standard Import: cli53 import --file <file> <domain>
• Replace existing records: cli53 import --file <file> --replace --wait <domain>
• Upsert (Add new, keep existing): cli53 import --file <file> --upsert <domain>
• Dry-run: Add --dry-run to see what would happen without making changes.
• Validate syntax: cli53 validate --file <file>

Exporting

• Standard Export: cli53 export <domain>
• Full FQDN Export: Use --full to export fully-qualified domain names instead of prefixes.

Troubleshooting CNAMEs: If importing from providers like GoDaddy, ensure CNAME/MX records have a trailing dot. If they don't, use this regex to fix them:

perl -pe 's/((CNAME|MX\s+\d+)\s+[-a-zA-Z0-9._]+)(?!.)$/$1./i' broken.txt > fixed.txt

cli53 import --file zonefile.txt --replace --wait --dry-run example.com
cli53 export --full --debug example.com > example.com.txt 2> example.com.err.log

cli53 uses standard AWS credential loading. You can configure access in two ways:

1. AWS Credentials File

Place your credentials in ~/.aws/credentials:

[default]
aws_access_key_id = AKID1234567890
aws_secret_access_key = MY-SECRET-KEY

2. Environment Variables

Set the following environment variables:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

Switching Profiles and Roles

• Profiles: Use the --profile flag or set the AWS_PROFILE environment variable to switch between credential sets.
• Roles: Use the --role-arn flag to assume a specific IAM role. You can combine --profile and --role-arn.
• Endpoint URL: Use the --endpoint-url flag to specify a custom Route 53 endpoint (useful for testing).

cli53 list --profile my_profile
cli53 list --role-arn arn:aws:iam::123456789012:role/myRole
cli53 list --endpoint-url "http://localhost:4580"

Use rrcreate to add records and rrdelete to remove them.

Basic Records

• A Record: cli53 rrcreate <domain> '<name> <ttl> A <ip>'
• MX Record: cli53 rrcreate <domain> '@ MX 10 mail1.' '@ MX 20 mail2.'
• CNAME Record:
  • Relative: cli53 rrcreate example.com 'login CNAME www'
  • Absolute: cli53 rrcreate example.com 'mail CNAME ghs.googlehosted.com.' (requires trailing dot)

Advanced AWS Record Types

• Weighted: Use --identifier <id> --weight <weight>.
• Alias (to ELB): cli53 rrcreate <domain> 'www AWS ALIAS A <dns-name> <zone-id> false'
• Alias (to A/CNAME record): cli53 rrcreate <domain> 'www AWS ALIAS A <identifier> $self false'
• Geolocation: Use -i <location> --continent-code <code|--country-code <code|--subdivision-code <code>.
• Failover: Use -i <id> --failover <PRIMARY|SECONDARY> --health-check <id>.
• Multivalue: Use -i <id> --multivalue --health-check <id>.

Deleting Records

• cli53 rrdelete <domain> <name> <type>

cli53 rrcreate example.com 'www 60 A 192.168.0.1'
cli53 rrcreate --replace example.com 'www 60 A 192.168.0.2'
cli53 rrdelete example.com www A

To allow cli53 to manage Route 53, attach the following IAM policy to your user or role.

Security Warning: The Cli53ManageZones and Cli53ManageDelegationSets statements use "Resource": "*", which grants permission to modify any hosted zone or delegation set in the account. For better security, scope these to specific ARNs:

"Resource": [
  "arn:aws:route53:::delegationset/Z123ABC",
  "arn:aws:route53:::hostedzone/Z456DEF"
]

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Cli53AccountLevelRead",
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListHostedZonesByName",
        "route53:ListReusableDelegationSets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Cli53Create",
      "Effect": "Allow",
      "Action": [
        "route53:CreateHostedZone",
        "route53:CreateReusableDelegationSet"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Cli53ManageZones",
      "Effect": "Allow",
      "Action": [
        "route53:GetHostedZone",
        "route53:ListResourceRecordSets",
        "route53:ChangeResourceRecordSets",
        "route53:DeleteHostedZone"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Cli53ManageDelegationSets",
      "Effect": "Allow",
      "Action": [
        "route53:DeleteReusableDelegationSet"
      ],
      "Resource": "*"
    }
  ]
}