Medium
Route53
Route 53 public hosted zones should log DNS queries
NIST 800-53PCI DSS v4.0.1PCI DSS v10.4.2ISO 27001HIPAA
Description
Confirms that DNS query logging is enabled for Route 53 public hosted zones.
Remediation
Enable Route 53 query logging for public hosted zones and send logs to CloudWatch Logs.
Steps
- Open the Amazon Route 53 console.
- Choose 'Hosted zones' and select the public hosted zone.
- Choose 'Create query logging config' and select a CloudWatch Logs log group.
- Save the configuration and verify logs are being delivered.
Compliance
NIST 800-53PCI DSS v4.0.1PCI DSS v10.4.2ISO 27001HIPAA