Route53 public hosted zone has query logging enabled

Check ID: route53_public_hosted_zones_cloudwatch_logging_enabled
Provider: AWS
Service: route53
Severity: MEDIUM
Categories: logging
Resource type: AwsRoute53HostedZone

What this check verifies

Route 53 public hosted zones have DNS query logging enabled to CloudWatch Logs, recording resolver requests for the zone and writing events to an associated log group.

Risk

Missing DNS query logs removes visibility into domain use, weakening detection of:

Data exfiltration via DNS
Malware C2/DGA patterns
Hijacking or misconfigurations This degrades incident response, threatens data confidentiality and integrity, and slows availability troubleshooting.

Recommendation

Enable Route 53 query logging for public zones to a centralized CloudWatch Logs group. Apply least privilege to log delivery, set retention and metric filters/alerts, and stream to your SIEM. Use defense in depth by correlating DNS logs with network and endpoint telemetry and regularly review baselines.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws route53 create-query-logging-config —hosted-zone-id <HOSTED_ZONE_ID> —cloud-watch-logs-log-group-arn <LOG_GROUP_ARN>

# Enable Route53 query logging for a public hosted zone
resource "aws_route53_query_log" "example" {
  zone_id                   = "<example_resource_id>"        # Critical: target hosted zone
  cloudwatch_log_group_arn  = "<example_log_group_arn>"      # Critical: delivers logs to this CloudWatch Logs group
}

# CloudFormation: Enable query logging for a public hosted zone
Resources:
  <example_resource_name>:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: <example_domain_name>
      QueryLoggingConfig:
        CloudWatchLogsLogGroupArn: <example_log_group_arn>  # Critical: enables Route53 query logging to this CloudWatch Logs group

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = route53_public_hosted_zones_cloudwatch_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Route 53 domain has Transfer Lock enabled S3 access point has all Block Public Access settings enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires