I’m trying to create an IAM policy to make sure the users I apply it to can only see a specific set of hosted zones (say hz1 and hz2) in Route 53.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:ListHostedZonesByName"
            ],
            "Resource": "*",
                        // SOME CONDITION THAT WILL DISPLAY ONLY THE SPECIFIED HOSTED ZONE
        },
        {
            "Effect": "Allow",
            "Action": [
                "route53:GetHostedZone",
                "route53:ListResourceRecordSets",
                "route53:ChangeResourceRecordSets",
                "route53:CreateHealthCheck",
                "route53:DeleteHealthCheck",
                "route53:GetHealthCheck",
                "route53:UpdateHealthCheck",
                "route53:GetHealthCheckCount",
                "route53:ListHealthChecks"
            ],
            "Resource": [
                "arn:aws:route53:::hostedzone/hz1",
                "arn:aws:route53:::hostedzone/hz2"
            ]
        }
    ]
}

We want the user to be able to manage the zone as they please but we’d like to keep other zones we have in our Route 53 console hidden, as they are not related to this user’s activities. Is there any way I can implement this with conditions? Something like:

"Condition": {
    "StringEquals": {
        "route53:AssociatedResource": [
            "arn:aws:route53:::hostedzone/hz1"
        ]
    }
}

This is just an example. I know it doesn’t work but I was thinking maybe there’s some kind of condition that will achieve what we need.

So far I haven’t tried anything other than what I suggested as an example.