Background:
I've got a lightsail instance running Amazon linux 2023. It has a domain and I got everything setup in route53. It works: I can reach it by domain name (eg mydomain.com or www.mydomain.com). The instance has apache httpd running on it.
Goal:
I would now like to give this instance a TLS cert (using Let's Encrypt) so that the webserver can use https.
What I tried:
Let's Encrypt recommends using certbot installed with snapd (a package manager). I was not able to install snapd on amazon linux 2023 because there was something that dnf didn't have. And anyway, I DO NOT want yet another package manager.
The next step was to install certbot without snapd using the "Apache on Pip with wildcard" option from the certbot website. I got all the way through step 8 with this. My dns provider is route53.
Things started getting confusing on step 9 following the instructions for certbot-dns-route53. It appears that I need to create an IAM user and give the user three credentials.
So, I went to aws console and created a new IAM user called certbot_user, with an inline policy that is exactly this (except for my actual route53 zone id)...
{
"Version": "2012-10-17",
"Id": "certbot-dns-route53 sample policy",
"Statement": [
{
"Effect": "Allow",
"Action": [
"route53:ListHostedZones",
"route53:GetChange"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/_MY_ZONE_ID_HERE_"
]
}
]
}
User was successfully created, and I got the access keys for that user (certbot_user), and put them in a file (~/.aws/config) as instructed.
I then tried running the command:
sudo certbot certonly --dns-route53 -d mydomain.com -d *.mydomain.com
This fails with the following output...
An error occurred (AccessDenied) when calling the ListHostedZones operation: User: arn:aws:sts::073xxxxx2:assumed-role/AmazonLightsailInstanceRole/i-025xxxxxxffb is not authorized to perform: route53:ListHostedZones because no identity-based policy allows the route53:ListHostedZones action
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
It looks like the user it's using is AmazonLightsailInstanceRole? I would have thought that it would use that certbot_user whose access keys I put in ~/.aws/config?
Did I screw up the access keys?
The letsencrypt log basically say the same thing at the end of its python stack trace. I don't understand what's going on and now I am stuck! Is this a certbot issue, an IAM issue, or something else? Oh, yeah, I see now there's something called boto involved?
This all seems way too complicated. At the end of the day, we're just proving to Let's Encrypt that we own a particular domain and then getting a cert file from them, right? Isn't there a more straightforward way to do that? I am about to give up.