VPC is associated with a hosted zone owned by another account
- Severity
- Info
- Service
- Route 53
- Check ID
- FOREIGN_HOSTED_ZONE
What this check finds
Hosted Zones have legitimate uses, but may also be used to redirect traffic by an attacker, especially when they are owned by another account.
Passing looks like: No foreign hosted zones.
How to fix it
Review the hosted zone to confirm it is expected and owned by a trusted account. If unexpected, investigate for DNS hijacking.
AWS console
Route53 → Hosted zones → review zone records and ownership.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs