Route53 hosted zone is protected by AWS Shield Advanced

Check ID: shield_advanced_protection_in_route53_hosted_zones
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: resilience
Resource type: AwsRoute53HostedZone

What this check verifies

Route 53 hosted zones have an active AWS Shield Advanced protection registered to the zone’s ARN.

Risk

Without Shield Advanced, authoritative DNS is vulnerable to:

Volumetric/reflection floods
Query/application layer attacks

Effects: disrupted resolution and app outages (availability), latency spikes, and unexpected cost from attack traffic.

Recommendation

Add critical Route 53 hosted zones as Shield Advanced protected resources to apply managed DDoS safeguards. Follow defense in depth: limit DNS exposure, enforce least-privilege for protection changes, monitor traffic baselines, and prepare incident runbooks with clear escalation to speed response.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection --name <example_resource_name> --resource-arn arn:aws:route53:::hostedzone/<example_resource_id>

# Add Shield Advanced protection to a Route53 hosted zone
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "arn:aws:route53:::hostedzone/<example_resource_id>"  # Critical: Protects the hosted zone with Shield Advanced
}

# CloudFormation: Add Shield Advanced protection to a Route53 hosted zone
Resources:
  <example_resource_name>:
    Type: AWS::Shield::Protection
    Properties:
      ResourceArn: arn:aws:route53:::hostedzone/<example_resource_id>  # Critical: Protects the hosted zone with Shield Advanced

References

https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_route53_hosted_zones. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Internet-facing ALB is protected by Shield Advanced SNS subscription uses an HTTPS endpoint

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires