Route 53 record points at a CloudFront distribution not in this account

Severity: Low
Service: Route 53
Check ID: ROUTE53_DANGLING_CLOUDFRONT

What this check finds

A public DNS record points at a CloudFront domain that is not one of this account's distributions. Claiming it is not practical, since an alternate domain needs a certificate that covers it, but the record serves whatever that distribution does, or nothing. A distribution in another AWS account of yours also gives this result.

Passing looks like: No DNS record points at a CloudFront distribution this account does not own.

How to fix it

If the distribution is in another AWS account of yours, confirm it and suppress this finding. Otherwise delete the record or point it at a distribution you own.

AWS console

Route 53 → Hosted zones → select zone → select the record.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Route 53 record points at a CloudFront distribution not in this account
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	CM-8 System Component Inventory
NIST Cybersecurity Framework 2.0	ID.AM-01 Asset Management — Inventories of assets are maintained
ISO/IEC 27001:2022 Annex A	A.5.9 Inventory of information and other associated assets

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Route 53 checks

All Route 53 checks