Second official DNS plugin, proving the subprocess protocol is provider-agnostic. Wraps aws-sdk-route53 for the four ops — zone lookup by DNS name (walks parent domains and hits list_hosted_zones_by_name), list_txt, upsert_txt, delete_txt. Route 53 lacks per-record IDs so (name, type) is the identity; upserts use a single UPSERT ChangeResourceRecordSets. Credential schema: access_key + secret_key required, session_token (for STS) and region (default us-east-1) optional. TXT values are quoted + escape-sequence'd on the wire; a hand-rolled unquote handles the trailing \" edge case that a naive trim_matches would corrupt.