Description

Detects AWS Route 53 public hosted zones that do not have DNS query logging enabled. DNS query logging is important for security monitoring and auditing as it helps track DNS queries made to your domains, which is crucial for detecting potential DNS-based attacks and suspicious activities.

Detection Strategy

• Checks if the hosted zone is public (not a private zone)

• Verifies if any query logging configurations exist for the hosted zone

• Reports a vulnerability if a public hosted zone has no query logging configurations enabled

• Only evaluates Route 53 hosted zones in the specified AWS region