Back to Checks
aws

Route53 public hosted zone has query logging enabled to a CloudWatch Logs log group

route53_public_hosted_zones_cloudwatch_logging_enabled
Service: route53Severity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRoute53HostedZone

Route 53 public hosted zones have DNS query logging enabled to CloudWatch Logs, recording resolver requests for the zone and writing events to an associated log group.

Prowler logoProwlerprowler-provider-aws

Risk

Missing DNS query logs removes visibility into domain use, weakening detection of:

  • Data exfiltration via DNS
  • Malware C2/DGA patterns
  • Hijacking or misconfigurations This degrades incident response, threatens data confidentiality and integrity, and slows availability troubleshooting.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks route53_public_hosted_zones_cloudwatch_logging_enabled

Recommendation

Enable Route 53 query logging for public zones to a centralized CloudWatch Logs group. Apply least privilege to log delivery, set retention and metric filters/alerts, and stream to your SIEM. Use defense in depth by correlating DNS logs with network and endpoint telemetry and regularly review baselines.

Remediation

CLI

aws route53 create-query-logging-config --hosted-zone-id <HOSTED_ZONE_ID> --cloud-watch-logs-log-group-arn <LOG_GROUP_ARN>

Terraform

# Enable Route53 query logging for a public hosted zone
resource "aws_route53_query_log" "example" {
  zone_id                   = "<example_resource_id>"        # Critical: target hosted zone
  cloudwatch_log_group_arn  = "<example_log_group_arn>"      # Critical: delivers logs to this CloudWatch Logs group
}

NativeIaC

# CloudFormation: Enable query logging for a public hosted zone
Resources:
  <example_resource_name>:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: <example_domain_name>
      QueryLoggingConfig:
        CloudWatchLogsLogGroupArn: <example_log_group_arn>  # Critical: enables Route53 query logging to this CloudWatch Logs group

Other

1Open the AWS Console and go to Route 53 > Hosted zones
2Select the public hosted zone
3Choose Query logging > Enable
4Select the target CloudWatch Logs log group and click Save
5If prompted, allow Route 53 to write to the log group (approve the CloudWatch Logs resource policy)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.route53.route53_client import route53_client


class route53_public_hosted_zones_cloudwatch_logging_enabled(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for hosted_zone in route53_client.hosted_zones.values():
            if not hosted_zone.private_zone:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=hosted_zone
                )
                if (
                    hosted_zone.logging_config
                    and hosted_zone.logging_config.cloudwatch_log_group_arn
                ):
                    report.status = "PASS"
                    report.status_extended = f"Route53 Public Hosted Zone {hosted_zone.id} has query logging enabled in Log Group {hosted_zone.logging_config.cloudwatch_log_group_arn}."

                else:
                    report.status = "FAIL"
                    report.status_extended = f"Route53 Public Hosted Zone {hosted_zone.id} has query logging disabled."

                findings.append(report)

        return findings

References