# Building Near Real-Time Amazon Route 53 DNS Change Alerts on AWS

DNS changes are powerful and risky. A single incorrect Route 53 record can cause outages, security exposure, or compliance issues. A simple but effective governance control is to get alerted whenever a DNS record is created, updated, or deleted.

This guide walks through a repeatable, AWS-native pattern to implement near real-time alerts for Route 53 DNS record changes using CloudTrail, EventBridge, and SNS.

## What this solution does

*   Detects any Route 53 DNS record change (CREATE, UPDATE, DELETE)
    
*   Works for public or private hosted zones
    
*   Provides visibility into:
    
    *   Who made the change
        
    *   Which record was modified
        
    *   When and from where
        
*   Requires no agents and no third-party tools
    
*   Scales across accounts and organizations
    

## High-level architecture

1.  AWS CloudTrail captures Route 53 API calls
    
2.  Amazon EventBridge filters DNS change events
    
3.  Amazon SNS delivers notifications by email or other supported endpoints
    

Route 53 record changes are API calls using `ChangeResourceRecordSets`. CloudTrail is the authoritative source for these events.

## Prerequisites

Before starting, ensure the following:

1.  CloudTrail is enabled and logging management write events
    
2.  You have permission to create:
    
    *   EventBridge rules
        
    *   SNS topics and subscriptions
        
3.  You know the hosted zone ID you want to monitor
    

> Important: Route 53 is a global service, so EventBridge rules for this use case should be created in `us-east-1`.

## Step 1: Verify CloudTrail is logging Route 53 changes

1.  Open **CloudTrail**
    
2.  Go to **Event history**
    
3.  Filter by:
    
    *   Event source = `route53.amazonaws.com`
        
4.  Create or update a DNS record in Route 53
    
5.  Confirm an event named `ChangeResourceRecordSets` appears
    

Open the event and note the exact value of:

```text
requestParameters.hostedZoneId
```

Always use the exact value shown in CloudTrail.

## Step 2: Create an SNS topic for notifications

1.  Open **Amazon SNS** in `us-east-1`
    
2.  Create a **Standard** topic
    
3.  Create an **email subscription**
    
4.  Confirm the subscription from your inbox
    

Test delivery by publishing a sample message to the topic.

## Step 3: Create an EventBridge rule

1.  Open **Amazon EventBridge** in `us-east-1`
    
2.  Create a new rule
    
3.  Select:
    
    *   Event source: AWS events
        
    *   Event type: **AWS API Call via CloudTrail**
        
4.  Choose **Custom pattern (JSON editor)**
    

Use the following pattern and replace the hosted zone ID with your own:

```json
{
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["route53.amazonaws.com"],
    "eventName": ["ChangeResourceRecordSets"],
    "requestParameters": {
      "hostedZoneId": ["<HOSTED_ZONE_ID>"]
    }
  }
}
```

### Why this pattern works

*   It filters CloudTrail API events reliably
    
*   It avoids over-filtering on unstable fields like the top-level `source`
    
*   It captures all DNS record changes for the target hosted zone
    

## Step 4: Configure SNS as the rule target

1.  Set the EventBridge rule target to **SNS**
    
2.  Select your SNS topic
    
3.  Allow EventBridge to create or use its service role if required by your environment
    

> In restricted environments, IAM permissions may need to be explicitly granted for EventBridge to create its invoke role and related policy.

## Step 5: Test the solution

1.  Create or delete a DNS record
    
2.  Check:
    
    *   EventBridge → Monitoring for matched events
        
    *   Your email inbox for the SNS notification
        

You should receive an alert within seconds.

## IAM considerations

In tightly controlled environments, especially AWS Organizations management accounts, you may hit IAM permission errors when EventBridge tries to create its service role and policy for SNS publishing.

Typical missing permissions include:

*   `iam:CreateRole`
    
*   `iam:PassRole`
    
*   `iam:AttachRolePolicy`
    
*   `iam:PutRolePolicy`
    
*   `iam:CreatePolicy`
    
*   `iam:GetPolicy`
    
*   `iam:GetPolicyVersion`
    
*   `iam:CreatePolicyVersion`
    
*   `iam:DeletePolicyVersion`
    

One practical approach is to allow EventBridge to create only the required invoke role and associated policy resources. Another option is to have the security team pre-create the role and policy for you.

## Troubleshooting tips

### 1\. No events matched in EventBridge

Check the following:

*   The EventBridge rule is in `us-east-1`
    
*   The rule is enabled
    
*   The event bus is `default`
    
*   The event pattern uses the exact `hostedZoneId` value from CloudTrail
    
*   The rule is based on **AWS API Call via CloudTrail**
    

### 2\. CloudTrail shows events but EventBridge does not match

Prefer filtering on:

*   `detail.eventSource`
    
*   `detail.eventName`
    

Avoid relying too heavily on the top-level `source` field.

### 3\. SNS is not delivering emails

Check:

*   The SNS subscription is confirmed
    
*   You can manually publish to the topic successfully
    
*   The EventBridge rule target is correctly configured
    

### 4\. Email formatting is not clean

EventBridge input transformers have limitations, and SNS email delivery does not render string templates nicely with line breaks.

If you want:

*   Clean multi-line emails
    
*   Custom email subject
    
*   Better formatting
    
*   Support for multiple DNS record changes in a single request
    

Then use:

```text
EventBridge → Lambda → SNS
```

## Optional enhancements

### Filter by action type

If you only want to detect specific actions, such as deletes, you can refine the filtering logic. For example, with a Lambda-based solution you can filter for:

*   CREATE
    
*   DELETE
    
*   UPSERT
    

### Monitor multiple hosted zones

You can scale this design by either:

*   Creating one rule per hosted zone
    
*   Removing the hosted zone filter and handling routing or formatting logic in Lambda
    

### Improve notification formatting

A Lambda function can:

*   Build a clean, multi-line email
    
*   Set a custom subject
    
*   Add severity levels
    
*   Handle multiple DNS changes in one request
    

## When to use AWS Config instead

AWS Config is useful for:

*   Compliance monitoring
    
*   Configuration history
    
*   Drift tracking
    

CloudTrail plus EventBridge is better for:

*   Near real-time alerting
    
*   Operational visibility
    
*   Security monitoring
    

## Final thoughts

This solution provides a lightweight, scalable, and repeatable way to monitor DNS changes across AWS environments.

It is especially valuable for:

*   Production environments
    
*   Security monitoring
    
*   Compliance and audit visibility
    

Once implemented, it becomes a low-effort, high-impact governance control that can be reused across many AWS accounts and organizations.