#7873·certbot

Allow specifying the credentials file in dns-route53

Author: bmwCreated Apr 1, 2020Updated Jul 17, 2026
Labelsfeature requestarea: dns

We originally got a PR for this at https://github.com/certbot/certbot/pull/5781. The good description of why this is valuable that was provided there was:

The current Route53 DNS plugin doesn't allow directly specifying credentials to use, which means:

  1. No way to use different AWS credentials for different certificates.

  2. The way Boto3 loads default credentials always depends on environment variables, whether it's $HOME (loading ~/.aws/file), or $AWS_* environment variables directly.

    The environment will probably be different on renewals, so people could pass $AWS_* variables to certonly and successfully obtain the certificate, but later renewal from the cron job would fail unless they also modify /etc/cron.d/certbot.

    sudo doesn't touch $HOME by default, so sudo certbot ... would read /home/user/.aws, while sudo -H certbot ... would read /home/root/.aws, etc.

I moved the work that was done there into the route53-credentials-file branch on this repo in case anyone wants to build on it in the future.