Route 53 public hosted zones should log DNS queries

Checks that DNS query logging is enabled for the Route 53 public hosted zone, so the queries Route 53 answers for it (the name queried, record type, response code, time and edge location) are published to CloudWatch Logs, which gives visibility for DNS security and compliance.

service: Route53
severity: Medium
scope: evaluated once per account

How to fix it

In the console

Route 53 → Hosted zones → the hosted zone → Hosted zone details

Configure query logging: Create a configuration for this zone
Log group: A CloudWatch Logs log group in US East (N. Virginia), such as /aws/route53/<zone name>
Grant permissions: Accept, so a us-east-1 resource policy lets Route 53 write; at 10 policies, edit one instead

With the AWS CLI

aws route53 create-query-logging-config --hosted-zone-id <hosted-zone-id> --cloud-watch-logs-log-group-arn <log-group-arn>

With Terraform

resource "aws_route53_query_log" "this" {
  zone_id                  = var.zone_id
  cloudwatch_log_group_arn = var.log_group_arn
}

See which of your accounts this check is failing on.

Book a live scan