Guidance for securing ARC routing controls, safety rules, and zonal shift / zonal autoshift.
Least privilege: scope the IAM principals that operate routing controls and zonal shift to the specific actions they need — never service-level wildcards. For zonal shift / zonal autoshift: , , , and . For data-plane failover: , , , and . Scope each statement to the specific routing-control / resource ARNs involved.
Condition keys: further restrict access with IAM condition keys — e.g. scope route53-recovery-cluster:UpdateRoutingControlState to specific routing-control ARNs via the statement Resource, and use aws:ResourceTag to limit which resources a principal may shift. For cross-service access (such as Route53 health-check association), constrain with aws:SourceAccount / aws:SourceArn to avoid the confused-deputy problem.
Safety rules are a control: never create routing controls without safety rules — they prevent an operator from accidentally turning off all Regions at once. Consider a gating rule requiring approval for production failover.
Restrict failover access: limit which principals can change routing-control state, as a state change can shift production traffic between Regions.
Failover notifications: SNS topics and CloudWatch Logs groups carrying routing-control state-change or zonal-shift notifications SHOULD be KMS-encrypted and restricted to authorized personnel, since failover events reveal production resilience posture. Validate that SNS subscription endpoints (email, HTTP/S, Lambda ARNs) belong to authorized recipients before subscribing, and use an SNS topic access policy to restrict who may subscribe. (Notification/alarm setup itself is owned by the AWS Observability companion skill.)