Back to Checks
aws

Route53 hosted zone is protected by AWS Shield Advanced

shield_advanced_protection_in_route53_hosted_zones
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsRoute53HostedZone

Route 53 hosted zones have an active AWS Shield Advanced protection registered to the zone's ARN.

Prowler logoProwlerprowler-provider-aws

Risk

Without Shield Advanced, authoritative DNS is vulnerable to:

  • Volumetric/reflection floods
  • Query/application layer attacks

Effects: disrupted resolution and app outages (availability), latency spikes, and unexpected cost from attack traffic.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_route53_hosted_zones

Recommendation

Add critical Route 53 hosted zones as Shield Advanced protected resources to apply managed DDoS safeguards. Follow defense in depth: limit DNS exposure, enforce least-privilege for protection changes, monitor traffic baselines, and prepare incident runbooks with clear escalation to speed response.

Remediation

CLI

aws shield create-protection --name <example_resource_name> --resource-arn arn:aws:route53:::hostedzone/<example_resource_id>

Terraform

# Add Shield Advanced protection to a Route53 hosted zone
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "arn:aws:route53:::hostedzone/<example_resource_id>"  # Critical: Protects the hosted zone with Shield Advanced
}

NativeIaC

# CloudFormation: Add Shield Advanced protection to a Route53 hosted zone
Resources:
  <example_resource_name>:
    Type: AWS::Shield::Protection
    Properties:
      ResourceArn: arn:aws:route53:::hostedzone/<example_resource_id>  # Critical: Protects the hosted zone with Shield Advanced

Other

1Open the AWS WAF & Shield console
2Go to AWS Shield > Protected resources
3Click Add resources to protect
4Set Scope to Global and select resource type: Amazon Route 53 Hosted Zone
5Select the hosted zone and click Protect with Shield Advanced

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.route53.route53_client import route53_client
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_route53_hosted_zones(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for hosted_zone in route53_client.hosted_zones.values():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=hosted_zone
                )
                report.region = shield_client.region
                report.status = "FAIL"
                report.status_extended = f"Route53 Hosted Zone {hosted_zone.id} is not protected by AWS Shield Advanced."

                for protection in shield_client.protections.values():
                    if hosted_zone.arn == protection.resource_arn:
                        report.status = "PASS"
                        report.status_extended = f"Route53 Hosted Zone {hosted_zone.id} is protected by AWS Shield Advanced."
                        break

                findings.append(report)

        return findings

References