Detection: Route 53 Hosted Zone Associated with VPC
Overview
Detect when an Amazon Route 53 hosted zone was associated with an Amazon Virtual Private Cloud (VPC). Unauthorized or improper associations can expose internal DNS records, disrupt DNS resolution, or increase the attack surface. Monitoring these associations ensures private DNS functionality is securely configured and adheres to access control requirements.
References:
Usage
Run the detection in your terminal:
powerpipe detection run aws_cloudtrail_log_detections.detection.route_53_hosted_zone_associated_with_vpcSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run aws_cloudtrail_log_detections.detection.route_53_hosted_zone_associated_with_vpc --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,string_split(event_source, '.')[1] || ':' || event_name as operation,request_parameters ->> 'hostedZoneId' as resource,user_identity.arn as actor,tp_source_ip as source_ip,tp_index as account_id,aws_region as region,tp_id as source_id,*
from aws_cloudtrail_logwhere event_source = 'route_53.amazonaws.com' and event_name = 'AssociateVPCWithHostedZone' and error_code is null
order by event_time desc;