Use route 53 and create an iam policy that locks down access to a specific hosted zone.