Per-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absent
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws ec2 describe-vpcs --query 'Vpcs[].VpcId'$ aws route53resolver list-resolver-dnssec-configsExpected output
describe-vpcs yields the VpcId inventory for the Region. list-resolver-dnssec-configs yields ResolverDnssecConfigs[] with Id, OwnerId, ResourceId and ValidationStatus (ENABLING | ENABLED | DISABLING | DISABLED | UPDATING_TO_USE_LOCAL_RESOURCE_SETTING | USE_LOCAL_RESOURCE_SETTING); the array is paginated and carries NextToken.
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SC 13/35 →
GovCloud
Route 53 is available in both GovCloud (US) Regions and the GovCloud difference page documents no carve-out for Resolver DNSSEC validation; it does record that Route 53 Resolver delegation is unavailable for private hosted zones, which is a different feature. The Route 53 control plane for GovCloud is in GovCloud (US-West). VPC ARNs use partition arn:aws-us-gov.
Notes & assertions
Rated partial for a reason that is in AWS's own words rather than in our judgement of the control: ListResolverDnssecConfigs returns one element per DNSSEC validation configuration associated with the account and "doesn't contain disabled DNSSEC configurations for the resource". A VPC with validation off is therefore ABSENT from the array, not reported as DISABLED — so a check of the form "every returned entry is ENABLED" is vacuously true on an account that has enabled validation nowhere. That is the exact shape of a check that passes while proving nothing, so it is not written as an assertion. The decidable question is a set comparison: every VpcId from describe-vpcs must appear as a ResourceId in ResolverDnssecConfigs with ValidationStatus ENABLED. That spans two collections, and the assertion vocabulary compares a field against a constant rather than one command's output against another's, so the completeness half is a human read. The telemetry is real and specific; what it cannot do by itself is prove coverage. Two further limits worth attaching to the evidence. Validation is applied by the VPC Resolver when it performs recursive resolution, so if the VPC forwards to another resolver, that resolver is the one doing recursion and must validate — the AWS status says nothing about it. And the VPC Resolver ignores the DO and CD bits and does not set AD or return DNSSEC records, so a workload cannot perform its own validation downstream of it; where a system owes that, the artifact is the resolver it runs instead.
References
- ListResolverDnssecConfigs API — "It doesn't contain disabled DNSSEC configurations for the resource"; paginated with NextToken https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverDnssecConfigs.html
- AWS CLI: route53resolver get-resolver-dnssec-config (ResolverDNSSECConfig fields and the ValidationStatus value set) https://docs.aws.amazon.com/cli/latest/reference/route53resolver/get-resolver-dnssec-config.html
- Enabling DNSSEC validation in Amazon Route 53 (applied by the VPC Resolver during recursion; a forwarding resolver must validate itself; the VPC Resolver ignores DO/CD and does not set AD) https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html
- Amazon Route 53 in AWS GovCloud (US) — Region availability and documented differences https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Service Configuration run (10)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMScontinuousconfig-encryption-at-restAWS Config · Amazon S3 · Amazon EBS · Amazon RDS · AWS KMS
- partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLcontinuousconfig-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
- partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection controlcontinuousconfig-kms-key-managementAWS Config · AWS KMS
- partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than driftingcontinuousssm-configuration-baseline-enforcedAWS Config · AWS Systems Manager
- partialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evidentweeklyintegrity-verification-and-immutabilityAWS CloudTrail · AWS Config · Amazon S3 · AWS Backup · Amazon ECR
- partialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parentweeklyroute53-dnssec-signingAmazon Route 53 · AWS KMS
- partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absentyou are hereweeklyroute53-resolver-dnssec-validationAmazon Route 53 · Amazon VPC
- partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTPquarterlysession-authenticity-tls-terminationElastic Load Balancing · Amazon CloudFront · AWS Certificate Manager · AWS Config
- partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational statuscontinuousname-resolution-role-separationAmazon Route 53 · Amazon Route 53 Resolver
- partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.continuoussecret-exposure-detection-and-push-protectionGitHub secret scanning · GitHub code security configurations