Testing DNSSEC Cloudwatch Alarms

You need to have a hosted zone in the R53 service. AWS/Route53 namespace includes the metric for Route 53 hosted zones [1].

Once you have the hosted zones, you can create an alarm using the steps in the link [2].

DNSSECInternalFailure DNSSECKeySigningKeysNeedingAction DNSSECKeySigningKeyMaxNeedingActionAge

You can refer to the links -->

[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/monitoring-hosted-zones-with-cloudwatch.html#cloudwatch-dimensions-route-53-hosted-zones

[2] https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html