How do I get notifications when changes happen to my Route 53 hosted zone records?

Short description

Use a custom event pattern with an Amazon EventBridge rule or Amazon CloudWatch Events rule that initiates when you make the ChangeResourceRecordSets API call. Then, route the response to an Amazon Simple Notification Service (Amazon SNS) topic.

Note: If you don't have an Amazon SNS topic with an email subscription, then create an Amazon SNS topic and a subscription to an SNS topic.

Resolution

Prerequisite: To monitor AWS API Call via CloudTrail events, activate custom CloudTrail trails in the AWS Regions where you create the rules. To record events with one of the CloudTrail detail-type values, you must turn on logging for a trail. You can create a trail either in multiple Regions or in only the us-east-1 Region. For more information, see Working with CloudTrail trails.

Create an EventBridge rule

Note: Route 53 is an AWS global service that's available only in the US East (N. Virginia) AWS Region. You must create the EventBridge rule in the US East (N. Virginia) Region.

Complete the following steps:

1. Open the EventBridge console.

2. In the navigation pane, choose Rules.

3. Choose Create rule.

4. In the Name and Description fields, enter a name and description for the rule.

5. Select Enable the rule on the selected eventbus.

6. Choose Rule with an event pattern.

7. Choose Next.

8. Select AWS Events or EventBridge partner events.

9. Under Event pattern, choose the following options:
   In the Event source dropdown list, choose AWS services.
   In the AWS service dropdown list, choose Route 53.
   In the Event type dropdown list, choose AWS API Call via CloudTrail.

10. Choose Specific operation(s).

11. In Specific operation(s), enter ChangeResourceRecordSets to limit events to match only for create, delete, or updates to resource record sets.
    The following event pattern appears:

    {  
      "source": ["aws.route53"],  
      "detail-type": ["AWS API Call via CloudTrail"],  
      "detail": {  
        "eventSource": ["route53.amazonaws.com"],  
        "eventName": ["ChangeResourceRecordSets"]  
      }  
    }

12. Choose Next.

Associate the Amazon SNS target with the EventBridge rule

Complete the following steps:

1. Open the EventBridge console.
2. In the Target types section, select AWS service.
3. In the Select a target dropdown list, choose SNS topic.
4. In the Topic dropdown list, choose your Amazon SNS topic.

Configure the Input transformer option to customize the SNS notification

By default, EventBridge forwards the entire CloudTrail event to the target. Then, the Amazon SNS topic delivers a notification as unformatted JSON text.

When you use the Input transformer option on the EventBridge console, you can specify the fields in the inbound event. Then, the Input transformer transforms the event into a more human-readable message. 

In the following steps, the example Input path field includes the eventTime, hostedZone, username, and eventID. Change the fields to align with your use case. EventBridge automatically updates the field placeholders in the Input template with the fields that you configure in the Input transformer.

To customize an Amazon SNS notification, complete the following steps:

1. Open the EventBridge console.

2. Expand the Additional settings dropdown list.

3. In the Configure target input dropdown list, choose Input transformer.

4. Choose Configure Input transformer.

5. In the Input path field, enter the following code:

   {  
       "eventTime": "$.detail.eventTime",  
       "hostedZone": "$.detail.requestParameters.hostedZoneId",  
       "userName": "$.detail.userIdentity.sessionContext.sessionIssuer.userName",  
       "eventID": "$.detail.eventID"  
   }

6. In the Template field, enter the following text:
   "At eventTime, one or more Route 53 records within Hosted Zone hostedZone were modified by user userName. To view the event directly in your Event History and review these changes, use the following link. Note that the event may take up to 15 minutes to be available in your Event History: https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events?EventId=eventID"
   Note: Replace userName with your username.

7. Choose Confirm.

8. (Optional) Add tags to the EventBridge rule, and then choose Next.

9. Review the rule configuration, and then choose Create rule.

When you change the Route 53 resource sets, you now get a notification that's similar to the following:

"At 2022-08-16T21:02:46Z, one or more Route 53 records within Hosted Zone ZB3A123456789 were modified by user Admin. To view the event directly in your Event History and review these changes, use the following link. Note that the event may take up to 15 minutes to be available in your Event History: https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events?EventId=04d08662-537e-4424-97c2-8bc796943b75"

Related information

How do I create a custom event pattern for an EventBridge rule?

How do I create an EventBridge rule that uses the input transformer to make an Amazon SNS notification human readable?

Tutorial: Use input transformers to transform events in EventBridge

Tutorial: Create an EventBridge rule that reacts to AWS API calls via CloudTrail