Route 53 public DNS query logging is not configured

Record DNS queries for public hosted zones that need detailed logs.

Description

Without query logging for a Route 53 public hosted zone, CloudWatch Logs does not receive detailed records of the DNS queries Route 53 receives.

Potential impact

Troubleshooting DNS response errors and investigating unusual query patterns can become harder.

Remediation

Associate aws_route53_query_log with the zone and configure a log group in us-east-1 with permissions for Route 53 to write logs. Use separate Resolver query logging for private DNS.

Examples

These excerpts assume the log group and resource policy are configured separately. Public query logs do not include every client query answered from a resolver’s cache.

Before

hcl
resource "aws_route53_zone" "example" {
  name = "example.com"
}

After

hcl
resource "aws_route53_zone" "example_com" {
  name = "example.com"
}

resource "aws_route53_query_log" "example_com" {
  depends_on = [aws_cloudwatch_log_resource_policy.route53-query-logging-policy]

  cloudwatch_log_group_arn = aws_cloudwatch_log_group.aws_route53_example_com.arn
  zone_id                  = aws_route53_zone.example_com.zone_id
}

References