Description

Ensure that every Amazon Route 53 public hosted zone has DNS query logging enabled and sends the logs to an Amazon CloudWatch Logs log group. Query logging records the DNS queries that Route 53 receives for the domain, including the domain or subdomain requested, the record type, the edge location that answered and the response code. Private hosted zones are not evaluated.

Rationale

Without DNS query logs, there is no record of how the domain is being queried. This makes it harder to detect DNS-based data exfiltration, malware command-and-control or domain-generation patterns, DNS hijacking and misconfigurations, and slows down incident response and troubleshooting. Sending query logs to a central CloudWatch Logs log group with a defined retention, metric filters and alarms, and forwarding them to a SIEM where available, improves visibility of the domain's use.

Impact

  • Provides a record of DNS queries for security monitoring and troubleshooting

  • Allows alerts on unusual query patterns through CloudWatch metric filters and alarms

  • CloudWatch Logs ingestion and storage are charged, which can be significant for domains with high query volumes

  • DNS resolution is not affected

Default Value

Query logging is disabled by default for Route 53 public hosted zones.

Pre-Requisites

  • IAM permissions: route53:ListHostedZones, route53:ListQueryLoggingConfigs, route53:CreateQueryLoggingConfig, route53:DeleteQueryLoggingConfig, logs:CreateLogGroup, logs:DescribeResourcePolicies and logs:PutResourcePolicy

  • A CloudWatch Logs log group in the US East (N. Virginia) region (us-east-1), which is required for Route 53 query logging

  • A CloudWatch Logs resource policy in us-east-1 that allows Route 53 to write to the log group

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Route 53 console and select Hosted zones.

  3. Select a hosted zone of type Public and open its details.

  4. Check whether query logging is configured with a CloudWatch Logs log group.

  5. Repeat for each public hosted zone.

  6. If query logging is not configured, follow the implementation steps.

CLI:

List the public hosted zones:

aws route53 list-hosted-zones --query "HostedZones[?Config.PrivateZone==\`false\`].[Id,Name]" --output table

Show the query logging configuration of a hosted zone:

aws route53 list-query-logging-configs --hosted-zone-id <HOSTED_ZONE_ID>

A public hosted zone fails if QueryLoggingConfigs is empty, meaning no CloudWatch Logs log group is configured.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Route 53 console and select Hosted zones.

  3. Select the public hosted zone found in the Test Plan.

  4. Choose Configure query logging.

  5. Create a new log group, or select an existing log group in us-east-1. A name starting with /aws/route53/ is recommended.

  6. If prompted, grant Route 53 permission to write to the log group by creating the resource policy.

  7. Choose Create.

  8. Repeat for each affected public hosted zone.

CLI:

Create the log group in us-east-1:

aws logs create-log-group --region us-east-1 --log-group-name /aws/route53/<DOMAIN_NAME>

Save the following as route53-logs-policy.json:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"route53.amazonaws.com"},"Action":["logs:CreateLogStream","logs:PutLogEvents"],"Resource":"arn:aws:logs:us-east-1:<ACCOUNT_ID>:log-group:/aws/route53/*"}]}

Allow Route 53 to write to log groups whose names start with /aws/route53/ (this step is needed only once per account):

aws logs put-resource-policy --region us-east-1 --policy-name route53-query-logging --policy-document file://route53-logs-policy.json

Enable query logging for the hosted zone:

aws route53 create-query-logging-config --hosted-zone-id <HOSTED_ZONE_ID> --cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:<ACCOUNT_ID>:log-group:/aws/route53/<DOMAIN_NAME>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Route 53 console and select Hosted zones.

  3. Select the hosted zone and open its query logging configuration.

  4. Delete the query logging configuration and confirm.

CLI:

Delete the query logging configuration, using the ID returned by the Test Plan command:

aws route53 delete-query-logging-config --id <QUERY_LOGGING_CONFIG_ID>

Note: deleting the configuration stops DNS query logging for the zone. Logs already delivered stay in the log group according to its retention setting.

Reference