Creating and managing DNS records in Amazon Route 53 is a core capability for any AWS architecture that requires reliable name resolution. The CloudFormation resource type AWS::Route53::RecordSet provides a declarative mechanism to define and version control DNS entries, while the underlying Route 53 record type system defines the semantics of A, AAAA, CAA and alias records. This article exhaustively expands the reference material for AWS::Route53::RecordSet, the Route 53 resource record types, and protective operational practices for DNS zones and records.
Introduction
Amazon Route 53 is Amazon’s scalable Domain Name System service. It stores the association between a domain name and an IP address, or other DNS resource data. The service exposes a CloudFormation resource type AWS::Route53::RecordSet that allows infrastructure as code to create and update resource record sets in a hosted zone. The resource can be used as a standalone resource or as an embedded property in AWS::Route53::RecordSetGroup. Some properties of AWS::Route53::RecordSet are valid only when used within AWS::Route53::RecordSetGroup.
The Route 53 API operation ChangeResourceRecordSets underpins all create and update behavior for this resource. The documentation notes that for help getting started with CloudFormation, see the AWS CloudFormation User Guide. The Template Reference Guide for AWS::Route53::RecordSet was updated and users are instructed to update bookmarks and links.
The reference material also covers Route 53 record type semantics, including A records for IPv4 routing, AAAA records for IPv6 routing, CAA records for certificate authority authorization, and alias records which are an extension to DNS functionality that routes traffic to selected AWS resources such as CloudFront distributions and Amazon S3 buckets. A comparison of alias and non-alias records is referenced in the Route 53 Developer Guide.
Protecting Route 53 DNS zones and records is a separate operational concern. The blog post Protect your Amazon Route 53 DNS zones and records discusses proactive protection strategies including CloudTrail event monitoring with EventBridge alerts, IAM policies with least-privilege access, and organization-wide controls using Service Control Policies. Real-time alerts can be implemented by creating an EventBridge rule to trigger a Lambda every time a change is made to Route 53. Example configuration is Rule type: Rule with an event pattern, Events, Event source: AWS events or EventBridge partner events, Event Pattern: Event Source: AWS services, AWS Service: Route 53, Event Type: AWS API Call through AWS CloudTrail, Specific operation(s): Enter ChangeResourceRecordSets. A GitHub code sample for this backup solution is referenced.
Creating records by using the Amazon Route 53 console is documented in the Developer Guide. The procedure explains console creation. For complex routing configurations, the Traffic Flow visual editor can be used to save configuration as a traffic policy and associate the traffic policy with one or more domain names or subdomain names in the same hosted zone or multiple hosted zones. Rollback is available if new configuration is not performing as expected.
AWS::Route53::RecordSet CloudFormation Resource Definition
The AWS::Route53::RecordSet type defines information about the record that you want to create.
Syntax
JSON declaration uses Type: AWS::Route53::RecordSet and Properties block. Properties include AliasTarget, CidrRoutingConfig, Comment, Failover, GeoLocation, GeoProximityLocation, HealthCheckId, HostedZoneId, HostedZoneName, MultiValueAnswer, Name, Region, ResourceRecords, SetIdentifier, TTL, Type, Weight.
YAML declaration uses Type: AWS::Route53::RecordSet and Properties with AliasTarget, CidrRoutingConfig, Comment, Failover, GeoLocation, GeoProximityLocation, HealthCheckId, HostedZoneId, HostedZoneName, MultiValueAnswer, Name, Region, ResourceRecords as list of strings, SetIdentifier, TTL, Type, Weight.
Properties
AliasTarget
Alias resource record sets only. Information about the AWS resource, such as a CloudFront distribution or an Amazon S3 bucket, that you want to route traffic to. If creating resource record sets for a private hosted zone, note the following constraints: You can't create an alias resource record set in a private hosted zone to route traffic to a CloudFront distribution. For information about creating failover resource record sets in a private hosted zone, see Configuring Failover in a Private Hosted Zone in the Amazon Route 53 Developer Guide.
Required: No. Type: AliasTarget. Update requires: No interruption.
CidrRoutingConfig
The object that is specified in resource record set object when you are linking a resource record set to a CIDR location. A LocationName with an asterisk “*” can be used to create a default CIDR record. CollectionId is still required for default record.
Required: No. Type: CidrRoutingConfig. Update requires: No interruption.
Comment
Optional. Any comment for the record set.
The reference fact notes that the following are the available attributes and sample return values. For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.
Id
This element contains an ID that you use when performing a GetChange action to get detailed information about the change.
Examples are provided in Route 53 Template Snippets.
Example CloudFormation RecordSet Creations
Creating a Route 53 A record
The following example shows how to specify settings for an A record.
JSON
{ "Resources" : { "myDNSRecord" : { "Type" : "AWS::Route53::RecordSet", "Properties" : { "HostedZoneId" : "Z8VLZEXAMPLE", "Name" : "test.example.com", "ResourceRecords" : [ "192.0.2.99" ], "TTL" : "300", "Type" : "A" } } } }
YAML
Resources:
myDNSRecord:
Type: AWS::Route53::RecordSet
Properties:
HostedZoneId: Z8VLZEXAMPLE
Name: test.example.com
ResourceRecords:
- 192.0.2.99
TTL: 900
Type: A
Creating a Route 53 A record for an Amazon EC2 instance
The following example shows how to create an A record for an Amazon EC2 instance and how to use CloudFormation functions to get the required information.
The resource typically is an AWS resource, such as an EC2 instance or an ELB load balancer, and is referred to by an IP address or a DNS domain name, depending on the record type.
When Amazon Route 53 receives a DNS query for a domain name and type for which you have created latency resource record sets, Route 53 selects the latency resource record set that has the lowest latency between the end user and the associated Amazon EC2 Region. Route 53 then returns the value that is associated with the selected resource record set.
Notes about latency resource record sets:
You can only specify one ResourceRecord per latency resource record set.
You can only create one latency resource record set for each Amazon EC2 Region.
You aren't required to create latency resource record sets for all Amazon EC2 Regions.
Route 53 Record Types
Route 53 provides an extension to DNS functionality known as alias records. Similar to CNAME records, alias records let you route traffic to selected AWS resources, such as CloudFront distributions and Amazon S3 buckets. For more information, including a comparison of alias and non-alias records, see Choosing between alias and non-alias records.
Topics
A record type
You use an A record to route traffic to a resource, such as a web server, using an IPv4 address in dotted decimal notation.
Example for the Amazon Route 53 console
192.0.2.1
Example for the Route 53 API
<Value>192.0.2.1</Value>
AAAA record type
You use an AAAA record to route traffic to a resource, such as a web server, using an IPv6 address in colon-separated hexadecimal format.
Example for the Amazon Route 53 console
2001:0db8:85a3:0:0:8a2e:0370:7334
Example for the Route 53 API
<Value>2001:0db8:85a3:0:0:8a2e:0370:7334</Value>
CAA record type
A CAA record specifies which certificate authorities (CAs) are allowed to issue certificates for a domain or subdomain. Creating a CAA record helps to prevent the wrong CAs from issuing certificates for your domains.
Creating Records via Console and API
Creating records by using the Amazon Route 53 console
The following procedure explains how to create records using the Amazon Route 53 console. For information about how to create records using the Route 53 API, see ChangeResourceRecordSets in the Amazon Route 53 API Reference.
Note
To create records for complex routing configurations, you can also use the Traffic Flow visual editor and save the configuration as a traffic policy. You can then associate the traffic policy with one or more domain names (such as example.com) or subdomain names (such as www.example.com), in the same hosted zone or in multiple hosted zones. In addition, you can roll back the updates if the new configuration isn't performing as you expected it to.
Route 53 provides an extension to DNS functionality known as alias records. Similar to CNAME records, alias records let you route traffic to selected AWS resources, such as CloudFront distributions and Amazon S3 buckets. For more information, including a comparison of alias and non-alias records, see Choosing between alias and non-alias records.
Protecting Route 53 DNS Zones and Records
Proactive protection strategies for Route 53
Although backing up DNS data provides a safety net and the ability to restore records, preventing unauthorized deletions is crucial for maintaining your DNS infrastructure. In this section we explore some more protection layers you can implement to apply more safeguards for your Route 53 configurations:
CloudTrail event monitoring with EventBridge alerts
IAM policies with least-privilege access
Organization-wide controls using Service Control Policies (SCPs)
Implementing real-time alerts
Monitoring your DNS records for accidental or malicious activity is another critical step in being able to protect your applications. Detecting and alerting when a record is deleted can allow for proactive remediation and reduced downtime before an issue impacts your applications.
For example you could create an EventBridge rule to trigger the Lambda every time a change is made to Route 53 using the following configurations:
Rule type: Rule with an event pattern
Events
Event source: AWS events or EventBridge partner events
Event Pattern:
Event Source: AWS services
AWS Service: Route 53
Event Type: AWS API Call through AWS CloudTrail
Specific operation(s): Enter ChangeResourceRecordSets
Refer to this Route 53 GitHub for a code sample of this backup solution.
The AWS blog post emphasizes that backing up DNS data provides a safety net and ability to restore records, but preventing unauthorized deletions is crucial.
Operational Impact of RecordSet Properties
The HostedZoneId property identifies the hosted zone where the record set will be created. HostedZoneName can be used as an alternative identifier. Name specifies the DNS name for the record. Type specifies the record type such as A, AAAA, CAA, or alias.
TTL controls caching behavior. ResourceRecords is an array of string values. For A records this is IPv4 addresses. For AAAA records this is IPv6 addresses.
MultiValueAnswer enables returning multiple responses from Route 53 for a single query, which is useful for load balancing.
Weight enables weighted routing. Failover enables primary/secondary failover routing. GeoLocation enables geolocation routing. GeoProximityLocation enables proximity routing. Region is used with latency-based routing.
SetIdentifier is required for routing policies that need a unique identifier per record set, such as weighted, latency, failover, geolocation.
HealthCheckId associates a health check with a record set to enable health-based routing.
AliasTarget is used only for alias records and points to an AWS resource such as a CloudFront distribution or Amazon S3 bucket. In private hosted zones alias to CloudFront is not allowed.
CidrRoutingConfig links a record set to a CIDR location for CIDR-based routing. A LocationName with an asterisk “*” can be used to create a default CIDR record. CollectionId is still required for default record.
Comment allows documentation within the record set.
Update requires: No interruption for AliasTarget and CidrRoutingConfig indicates these can be changed without downtime.
The Id attribute returned by Fn::GetAtt can be used with GetChange to retrieve detailed change information.
Conclusion
The AWS::Route53::RecordSet CloudFormation resource type provides a declarative, versionable interface to manage DNS resource record sets in Amazon Route 53. The resource supports alias records for routing to AWS services, CIDR-based routing for IP prefix targeting, and the full suite of routing policies including failover, geolocation, latency, proximity, and weighted routing. Record types A and AAAA provide IPv4 and IPv6 address resolution, while CAA records enforce certificate authority constraints. Operational hardening of Route 53 requires CloudTrail monitoring, EventBridge alerts on ChangeResourceRecordSets API calls, least-privilege IAM, and Service Control Policies to prevent unauthorized deletions. Console creation and Traffic Flow visual editor offer alternative creation paths for complex routing configurations, and the ChangeResourceRecordSets API remains the underlying mechanism for all programmatic updates. Maintaining accurate HostedZoneId, Name, Type, TTL, and ResourceRecords properties ensures correct DNS resolution and safe infrastructure changes.