CloudWatch Logging Disabled

Query id: 7dbba512-e244-42dc-98bb-422339827967
Query name: CloudWatch Logging Disabled
Platform: Terraform
Severity: Medium
Category: Observability
CWE: 311
URL: Github

Description¶

Check if CloudWatch logging is disabled for Route53 hosted zones
Documentation

Code samples¶

Code samples with security vulnerabilities¶

Positive test num. 1 - tf file

resource "aws_route53_zone" "no_query_log" {
  name = "example.com"
}

resource "aws_route53_zone" "log_group_mismatch" {
  name = "example.com"
}

resource "aws_route53_query_log" "log_group_mismatch" {
  cloudwatch_log_group_arn = aws_cloudwatch_log_group.aws_route53_log_mismatch.arn
}

Code samples without security vulnerabilities¶

Negative test num. 1 - tf file

resource "aws_route53_zone" "example_com" {
  name = "example.com"
}

resource "aws_route53_query_log" "example_com" {
  depends_on = [aws_cloudwatch_log_resource_policy.route53-query-logging-policy]

  cloudwatch_log_group_arn = aws_cloudwatch_log_group.aws_route53_example_com.arn
  zone_id                  = aws_route53_zone.example_com.zone_id
}