How to fix Error: Error creating Route53 record: InvalidChangeBatch in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 156 views

The InvalidChangeBatch error occurs when Route53 rejects your Terraform resource record set changes due to conflicts, validation issues, or mismatched values. This guide covers the most common causes and solutions.

Quick fix

Fixes Error: Error creating Route53 record: InvalidChangeBatch

aws route53 list-resource-record-sets --hosted-zone-id YOUR_ZONE_ID
  1. List existing Route53 records in your hosted zone
  2. Verify the hosted zone ID in your Terraform configuration
  3. Check for conflicting record types
  4. Import existing records instead of recreating them
terraform — error
aws route53 list-resource-record-sets --hosted-zone-id YOUR_ZONE_ID
Error: Error creating Route53 record: InvalidChangeBatch

What this error means

The InvalidChangeBatch error is returned by AWS Route53 when you attempt to create, update, or delete DNS records through Terraform, but the requested changes violate Route53's validation rules. This is a client-side error returned by the AWS API, indicating that your change batch request is malformed or conflicts with existing records in your hosted zone. Route53 validates every change batch against several rules: duplicate records, conflicting record types, invalid domain names, mismatched values during deletion, and DNS naming conventions (like CNAME restrictions at zone apex). When any validation fails, Route53 rejects the entire batch and returns this error.

Typical symptoms

  • Terraform apply fails immediately when creating Route53 records
  • Error message shows InvalidChangeBatch with no details about which validation failed
  • Terraform destroy fails when trying to delete Route53 records
  • Creating CNAME records for domains that already have A records or other types
  • Trying to create records with domain names exceeding 255 character limit

Common causes

  1. Record already exists in Route53 with the same name and type
  2. Attempting to create conflicting record types (CNAME with A, MX, or other records at same name)
  3. Creating CNAME record for domain apex instead of using alias records
  4. Deleting record with values that don't match current Route53 values
  5. Invalid domain label length (labels must be 63 chars or less, total name max 255 chars)
  6. Empty or malformed domain name (double periods, empty labels)
  7. Alias record target zone ID doesn't match the resource's hosted zone
  8. TXT record value exceeding 255 character limit
  9. Terraform state out of sync with actual Route53 records

How to fix "Error: Error creating Route53 record: InvalidChangeBatch"

1List existing Route53 records in your hosted zone

First, check what records actually exist in Route53. Use the AWS CLI to inspect your hosted zone:

bash
aws route53 list-resource-record-sets --hosted-zone-id YOUR_ZONE_ID

Compare this output against the records you're trying to create in your Terraform configuration. Look for:
- Records with the exact same name and type as what you're creating
- Conflicting record types (CNAME mixed with A records)
- Values that differ from what Terraform expects to delete

This will reveal if the record already exists or has been modified outside Terraform.

2Verify the hosted zone ID in your Terraform configuration

Ensure your zone_id references the correct Route53 hosted zone:

hcl
resource "aws_route53_record" "example" {
  zone_id = aws_route53_zone.main.zone_id  # Must point to your actual zone
  name    = "example.com"
  type    = "A"
  ttl     = 300
  records = ["192.0.2.1"]
}

If using a hosted zone created outside Terraform, get the correct ID:

bash
aws route53 list-hosted-zones-by-name --dns-name example.com

Using the wrong zone ID will cause InvalidChangeBatch errors when the record name doesn't exist in that zone.

3Check for conflicting record types

Route53 doesn't allow CNAME records to coexist with other records at the same domain name. If you see a conflict error:

For zone apex (example.com):
- Don't create CNAME records - use alias records instead
- Alias records have alias block instead of records

hcl
# Wrong - CNAME at apex not allowed
resource "aws_route53_record" "apex" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "CNAME"
  ttl     = 300
  records = ["target.example.com"]  # ❌ INVALID
}

# Correct - use alias for apex
resource "aws_route53_record" "apex" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "A"
  alias {
    name                   = aws_cloudfront_distribution.main.domain_name
    zone_id                = aws_cloudfront_distribution.main.hosted_zone_id
    evaluate_target_health = false
  }
}

For subdomains (www.example.com):
- If a CNAME exists, remove it before adding A, MX, or TXT records
- Or import the CNAME and let Terraform manage it

bash
terraform import aws_route53_record.www ZONEID_www.example.com._CNAME
4Import existing records instead of recreating them

If the record already exists in Route53 but isn't in your Terraform state, import it:

bash
# Format: terraform import aws_route53_record.NAME ZONEID_RECORDNAME_TYPE

# Example: import A record for example.com
terraform import aws_route53_record.example Z1234567890ABC_example.com_A

# Example: import CNAME record for www.example.com
terraform import aws_route53_record.www Z1234567890ABC_www.example.com_CNAME

Get your zone ID with:

bash
aws route53 list-hosted-zones-by-name --dns-name example.com --query 'HostedZones[0].Id' --output text | cut -d'/' -f3

After importing, verify Terraform detects no changes:

bash
terraform plan
5Check TTL and record value format for delete operations

When deleting records, Terraform must match the exact values that currently exist. If the error occurs during destroy:

bash
# View what Terraform thinks should be deleted
terraform state show aws_route53_record.example

Ensure the values match Route53 exactly:
- TTL must match (default is usually 300)
- Record values must be identical
- For weighted/failover records, the set identifier must match

If values don't match, refresh Terraform state:

bash
terraform refresh
terraform plan  # See what it now detects

If this doesn't resolve it, you may need to manually delete the record in AWS and re-import:

bash
aws route53 change-resource-record-sets --hosted-zone-id ZONE_ID \
  --change-batch file://delete-change.json

Then re-import:

bash
terraform import aws_route53_record.example ZONE_ID_name_TYPE
6Validate domain name length and format

Route53 has strict DNS naming requirements:

hcl
resource "aws_route53_record" "example" {
  zone_id = aws_route53_zone.main.zone_id
  # name: Each label must be 63 chars or less
  # Total length including dots max 255 chars
  name    = "very-long-label-exceeding-63-characters-will-fail.example.com"  # ❌ BAD
  name    = "valid-label-under-63-chars.example.com"  # ✅ GOOD
  type    = "A"
  ttl     = 300
  records = ["192.0.2.1"]
}

Check for common issues:
- No empty labels (double dots: example..com)
- No trailing dots in the name variable (Route53 auto-adds them)
- All labels are lowercase alphanumeric, hyphens (no underscores in most cases)

If you see "DomainLabelTooLong" or "DomainLabelEmpty" in the error, fix the domain name format.

7Use allow_overwrite for records that may be managed elsewhere

If a record exists in Route53 and you want Terraform to take over, use the allow_overwrite parameter:

hcl
resource "aws_route53_record" "example" {
  zone_id         = aws_route53_zone.main.zone_id
  name            = "example.com"
  type            = "A"
  ttl             = 300
  records         = ["192.0.2.1"]
  allow_overwrite = true  # Allow overwriting existing records
}

This tells Terraform to replace the record if it differs, rather than failing with InvalidChangeBatch. Use with caution if the record is managed outside Terraform.

Advanced notes

State Synchronization: InvalidChangeBatch errors often indicate your Terraform state is out of sync with actual Route53 records. This can happen if records are created/modified outside Terraform. Always use terraform state show and terraform refresh to verify state matches reality.

Record Set Ordering: When using weighted routing, failover routing, or geolocation routing, all records with the same name and type must have consistent set identifiers. Mismatched set identifiers in a change batch will cause InvalidChangeBatch errors.

Alias Records vs. Standard Records: AWS resources like CloudFront distributions, ALBs, and API Gateways must use alias records (which have no TTL), not standard A/AAAA records. Mixing record types for the same name will fail.

DNS Propagation: Even after resolving InvalidChangeBatch and applying successfully, Route53 changes may take a few minutes to propagate. During this window, DNS queries might still return old values.

Terraform Provider Version: Ensure you're using a recent aws provider version. Some InvalidChangeBatch scenarios have been improved in newer releases:

hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"  # Use recent stable version
    }
  }
}

Frequently asked questions

What does "Error: Error creating Route53 record: InvalidChangeBatch" mean?
The InvalidChangeBatch error is returned by AWS Route53 when you attempt to create, update, or delete DNS records through Terraform, but the requested changes violate Route53's validation rules. This is a client-side error returned by the AWS API, indicating that your change batch request is malformed or conflicts with existing records in your hosted zone. Route53 validates every change batch against several rules: duplicate records, conflicting record types, invalid domain names, mismatched values during deletion, and DNS naming conventions (like CNAME restrictions at zone apex).
How do I fix "Error: Error creating Route53 record: InvalidChangeBatch"?
The InvalidChangeBatch error occurs when Route53 rejects your Terraform resource record set changes due to conflicts, validation issues, or mismatched values. This guide covers the most common causes and solutions.
What causes "Error: Error creating Route53 record: InvalidChangeBatch"?
Record already exists in Route53 with the same name and type Attempting to create conflicting record types (CNAME with A, MX, or other records at same name) Creating CNAME record for domain apex instead of using alias records
Is the "Error: Error creating Route53 record: InvalidChangeBatch" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading