Configure cert-manager DNS01 challenges with Route53 to issue a wildcard certificate

Steps

1. Create an IAM policy granting route53:GetChange on arn:aws:route53:::change/*, route53:ChangeResourceRecordSets and route53:ListResourceRecordSets scoped to arn:aws:route53:::hostedzone/<HOSTED_ZONE_ID> (optionally restricted to TXT records via a route53:ChangeResourceRecordSetsRecordTypes condition), and route53:ListHostedZonesByName only if you omit hostedZoneID.
2. Pick a credential mechanism: ambient credentials (EKS Pod Identity, IRSA, IMDS, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars in the controller pod) let you leave solvers[].dns01.route53: {} empty; non-ambient credentials use accessKeyID plus secretAccessKeySecretRef (name/key of a Secret) or a dedicated ServiceAccount via auth.kubernetes.serviceAccountRef.name combined with role: <ROLE_ARN>.
3. Create a ClusterIssuer (or Issuer) with spec.acme.solvers containing a dns01.route53 block that sets region: <AWS_REGION> and hostedZoneID: <HOSTED_ZONE_ID> (recommended when the account has multiple hosted zones) plus the chosen credential fields.
4. Request the wildcard by creating a Certificate whose dnsNames include both '*.example.com' and 'example.com', referencing the ClusterIssuer by name/kind - DNS01 is mandatory here because ACME cannot validate wildcard SANs with HTTP01.
5. Apply the manifests and run kubectl describe certificate <name> and kubectl describe challenge to confirm the _acme-challenge TXT record was written to Route53 and validated before the Certificate's Ready condition flips to True.