aws-route53-query-log-event
DNS query logs reveal queried names; applications that place credentials or user identifiers in hostnames leak them into logs.
Where it sits
| location | CloudWatch Logs Route 53 query log event.message |
|---|
| location kind | log_field |
|---|
| data kinds | pii sensitive_data credential |
|---|
| emits edge | ContainsSecret |
|---|
| service | Route 53 (aws:route53) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | logs:FilterLogEvents |
|---|
| response path | Events[].Message |
|---|
| encoding | string |
|---|
| params | {"LogGroupName": "\u003croute53-query-log-group\u003e"} |
|---|
Required permissions
logs:FilterLogEvents
route53:GetQueryLoggingConfig
References