Minimal R53 permissions needed to support DDNS updates, ala: https://gist.github.com/nmcclain/8509874

aws_route53_IAM_ddns_permissions

{
   "Statement":[
      {
         "Action":[
            "route53:ChangeResourceRecordSets",
            "route53:GetHostedZone",
            "route53:ListResourceRecordSets"
         ],
         "Effect":"Allow",
         "Resource":[
            "arn:aws:route53:::hostedzone/ZONEIDGOESHERE"
         ]
      },
      {
         "Action":[
            "route53:GetChange"
         ],
         "Effect":"Allow",
         "Resource":[
            "arn:aws:route53:::change/*"
         ]
      },
      {
         "Action":[
            "route53:ListHostedZones"
         ],
         "Effect":"Allow",
         "Resource":[
            "*"
         ]
      }
   ]
}