Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

Route53 public hosted zone should log DNS queries

AWS_ROUTE53_004 MEDIUM Observability

What it checks

Route53 public hosted zone should log DNS queries

Where it applies

Terraform: aws_route53_zone

CloudFormation: AWS::Route53::HostedZone

How to fix it

  1. Create a CloudWatch Logs log group in us-east-1 (the only Region Route 53 publishes query logs to) and a CloudWatch Logs resource policy allowing route53.amazonaws.com to write to it.
  2. Add an aws_route53_query_log with zone_id pointing at this public hosted zone and cloudwatch_log_group_arn pointing at that log group. Private hosted zones are out of scope — Route 53 logs public DNS queries only.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules