AWS Route 53 Query Log

This page shows how to write Terraform and CloudFormation for Route 53 Query Log and write them securely.

aws_route53_query_log (Terraform)

The Query Log in Route 53 can be configured in Terraform with the resource name aws_route53_query_log. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub
resource "aws_route53_query_log" "route53LoggingDisabled" {

  cloudwatch_log_group_arn = "arn:aws:logs:us-west-1:123456789012:log-group:/route53Logging-12ABC1AB12A1:*."
  zone_id                  = "some-route53zone-id"
resource "aws_route53_query_log" "route53_query_log" {
  count = var.enable_route53_query_log ? 1 : 0

  cloudwatch_log_group_arn = var.route53_query_log_cloudwatch_log_group_arn
  zone_id                  = var.route53_query_log_zone_id != "" ? var.route53_query_log_zone_id : (var.enable_route53_zone ? element(aws_route53_zone.route53_zone.*.id, 0) : null)
resource "aws_route53_query_log" "example" {
  depends_on = [aws_cloudwatch_log_resource_policy.route53-query]

  cloudwatch_log_group_arn = aws_cloudwatch_log_group.example.arn
  zone_id                  = aws_route53_zone.example.zone_id
resource "aws_route53_query_log" "this" {
  cloudwatch_log_group_arn = var.cloudwatch_log_group_arn
  zone_id                  = var.zone_id
resource "aws_route53_query_log" "dns_log_query" {
  depends_on = [aws_cloudwatch_log_resource_policy.dns_log_policy]

  cloudwatch_log_group_arn = aws_cloudwatch_log_group.dns_log_group.arn
  zone_id                  = aws_route53_zone.myzone.zone_id

Review your Terraform file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).


Explanation in Terraform Registry

Provides a Route53 query logging configuration resource.

NOTE: There are restrictions on the configuration of query logging. Notably, the CloudWatch log group must be in the us-east-1 region, a permissive CloudWatch log resource policy must be in place, and the Route53 hosted zone must be public. See Configuring Logging for DNS Queries for additional details.

AWS::Route53::HostedZone QueryLoggingConfig (CloudFormation)

The HostedZone QueryLoggingConfig in Route53 can be configured in CloudFormation with the resource name AWS::Route53::HostedZone QueryLoggingConfig. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

An example could not be found in GitHub.


CloudWatchLogsLogGroupArn The Amazon Resource Name (ARN) of the CloudWatch Logs log group that Amazon Route 53 is publishing logs to.
Required: Yes
Type: String
Update requires: No interruption

Explanation in CloudFormation Registry

A complex type that contains information about a configuration for DNS query logging.

Frequently asked questions

What is AWS Route 53 Query Log?

AWS Route 53 Query Log is a resource for Route 53 of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS Route 53 Query Log?

For Terraform, the storebot/pr_demo_flat, asrkata/SebastianUA-terraform and JamesWoolfenden/terraform-aws-dns source code examples are useful. See the Terraform Example section for further details.