AWS Lightsail DNS

Lightsail has its own DNS API distinct from Route 53 — use this provider only if your zone lives in the Lightsail console, not if you registered your domain at Lightsail and delegated to Route 53.

Prerequisites

A Lightsail DNS zone. You can see them under Networking → DNS zones in the Lightsail console. If your zone doesn't appear there, use the Route 53 provider instead.
An IAM user or access key with the policy below.

IAM policy

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "lightsail:GetDomains",
      "lightsail:GetDomain",
      "lightsail:CreateDomainEntry",
      "lightsail:DeleteDomainEntry"
    ],
    "Resource": "*"
  }]
}

Lightsail doesn't support resource-level policies for DNS, so the actions must be *-scoped. If that is broader than your org policy allows, promote the zone to Route 53.

Add the credential

Settings → DNS Credentials → New → AWS Lightsail.
Access key ID / secret access key: paste.
DNS zone: the apex, e.g. example.com. Required — Lightsail's API doesn't infer the zone from the FQDN.
Region: defaults to us-east-1, which is correct for the global Lightsail DNS endpoint. Leave blank.
Test connectivity → Save.

Config fields

Field	Required	Purpose
`access_key_id`	yes	IAM access key.
`secret_access_key`	yes	IAM secret.
`dns_zone`	yes	Zone apex — Lightsail's API needs it explicitly.
`region`	no	Default `us-east-1`.

Propagation

Lightsail propagation is similar to Route 53 — under 30 seconds typically.

Caveats

One zone per credential. Unlike Route 53, the Lightsail provider needs dns_zone up front. Register one DNS credential per zone.
Env-var mutation. The lego Lightsail provider reads AWS credentials from env vars. CertAutoPilot serializes this with a mutex and restores the original env around each Present/CleanUp call — nothing to configure, just be aware.

Troubleshooting

"DNS zone not found"

The zone isn't in Lightsail. Either migrate it in (Lightsail has an import flow) or switch to Route 53.

"AccessDenied"

The IAM policy is missing the lightsail:*DomainEntry actions. See the policy above.

Prerequisites​

IAM policy​

Add the credential​

Config fields​

Propagation​

Caveats​

Troubleshooting​

"DNS zone not found"​

"AccessDenied"​

See also​