# Security Considerations — recovery-controller-setup

Guidance for securing ARC routing controls, safety rules, and zonal shift / zonal autoshift.

- **Least privilege:** scope the IAM principals that operate routing controls and zonal shift to the specific actions they need — never service-level wildcards. For zonal shift / zonal autoshift: `arc-zonal-shift:StartZonalShift`, `arc-zonal-shift:GetManagedResource`, `arc-zonal-shift:CreatePracticeRunConfiguration`, and `arc-zonal-shift:UpdateZonalAutoshiftConfiguration`. For data-plane failover: `route53-recovery-cluster:GetRoutingControlState`, `route53-recovery-cluster:UpdateRoutingControlState`, `route53-recovery-cluster:UpdateRoutingControlStates`, and `route53-recovery-cluster:ListRoutingControls`. Scope each statement to the specific routing-control / resource ARNs involved.
- **Condition keys:** further restrict access with IAM condition keys — e.g. scope `route53-recovery-cluster:UpdateRoutingControlState` to specific routing-control ARNs via the statement `Resource`, and use `aws:ResourceTag` to limit which resources a principal may shift. For cross-service access (such as Route53 health-check association), constrain with `aws:SourceAccount` / `aws:SourceArn` to avoid the confused-deputy problem.
- **Safety rules are a control:** never create routing controls without safety rules — they prevent an operator from accidentally turning off all Regions at once. Consider a gating rule requiring approval for production failover.
- **Restrict failover access:** limit which principals can change routing-control state, as a state change can shift production traffic between Regions.
- **Failover notifications:** SNS topics and CloudWatch Logs groups carrying routing-control state-change or zonal-shift notifications SHOULD be KMS-encrypted and restricted to authorized personnel, since failover events reveal production resilience posture. Validate that SNS subscription endpoints (email, HTTP/S, Lambda ARNs) belong to authorized recipients before subscribing, and use an SNS topic access policy to restrict who may subscribe. (Notification/alarm setup itself is owned by the AWS Observability companion skill.)
- **Further reading:** see [Security in Amazon Application Recovery Controller](https://docs.aws.amazon.com/r53recovery/latest/dg/security.html) and the [AWS Well-Architected Reliability Pillar](https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/) for guidance on securing resilience infrastructure.