Description
Without query logging for a Route 53 public hosted zone, CloudWatch Logs does not receive detailed records of the DNS queries Route 53 receives.
Potential impact
Troubleshooting DNS response errors and investigating unusual query patterns can become harder.
Remediation
Associate aws_route53_query_log with the zone and configure a log group in us-east-1 with permissions for Route 53 to write logs. Use separate Resolver query logging for private DNS.
Examples
These excerpts assume the log group and resource policy are configured separately. Public query logs do not include every client query answered from a resolver’s cache.
Before
hcl
resource "aws_route53_zone" "example" {
name = "example.com"
}
After
hcl
resource "aws_route53_zone" "example_com" {
name = "example.com"
}
resource "aws_route53_query_log" "example_com" {
depends_on = [aws_cloudwatch_log_resource_policy.route53-query-logging-policy]
cloudwatch_log_group_arn = aws_cloudwatch_log_group.aws_route53_example_com.arn
zone_id = aws_route53_zone.example_com.zone_id
}