Route 53 record points at an S3 bucket not in this account

Severity: High
Service: Route 53
Check ID: ROUTE53_DANGLING_S3

What this check finds

A public DNS record points at an S3 bucket endpoint, but this account has no bucket of that name. Bucket names are global and first come, first served: anyone can create the missing bucket and serve their content on your domain. A bucket in another AWS account of yours also gives this result.

Passing looks like: No DNS record points at an S3 bucket this account does not own.

How to fix it

If the bucket is in another AWS account of yours, confirm you still own it and suppress this finding. Otherwise delete the record, or create the bucket in this account before anyone else does.

AWS console

Route 53 → Hosted zones → select zone → select the record → Delete record.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Route 53 record points at an S3 bucket not in this account
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	CM-8 System Component Inventory
NIST Cybersecurity Framework 2.0	ID.AM-01 Asset Management — Inventories of assets are maintained
ISO/IEC 27001:2022 Annex A	A.5.9 Inventory of information and other associated assets

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Route 53 checks

All Route 53 checks