Route53 hosted zone should have DNSSEC signing enabled

What it checks

Route53 zone: this public hosted zone has no active DNSSEC signing resource bound to it.

Where it applies

Terraform: aws_route53_zone

CloudFormation: AWS::Route53::HostedZone

How to fix it

1. Create an ECC_NIST_P256 KMS key in us-east-1, a key signing key, and enable DNSSEC on the zone. Then add the DS record at your registrar. Private hosted zones are out of scope — Route 53 offers DNSSEC signing for public hosted zones only, and the chain of trust is established by a DS record in the parent zone.

Frameworks

• NIST 800-53 rev5 SC-20
• SOC 2 CC6.7

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules