Skip to content
AWS for Query.Farm

aws.route53.get_dnssec

Example SQL Queries

SELECT * FROM
aws.route53.get_dnssec
WHERE
"hosted_zone_id" = 'VALUE';

Description

Returns information about DNSSEC for a specific hosted zone, including the key-signing keys (KSKs) in the hosted zone.

Table Definition

Column NameColumn Data Type
hosted_zone_id Required Input Column

A unique string used to identify a hosted zone.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

key_signing_keys

The key-signing keys (KSKs) in your account.

STRUCT(
    "name" VARCHAR,
    "kms_arn" VARCHAR,
    "flag" BIGINT,
    "signing_algorithm_mnemonic" VARCHAR,
    "signing_algorithm_type" BIGINT,
    "digest_algorithm_mnemonic" VARCHAR,
    "digest_algorithm_type" BIGINT,
    "key_tag" BIGINT,
    "digest_value" VARCHAR,
    "public_key" VARCHAR,
    "ds_record" VARCHAR,
    "dnskey_record" VARCHAR,
    "status" VARCHAR,
    "status_message" VARCHAR,
    "created_date" TIMESTAMP_S,
    "last_modified_date" TIMESTAMP_S
)[]
Show child fields
key_signing_keys[]
Show child fields
key_signing_keys[].created_date

The date when the key-signing key (KSK) was created.

key_signing_keys[].digest_algorithm_mnemonic

A string used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by RFC-8624 Section 3.3.

key_signing_keys[].digest_algorithm_type

An integer used to represent the delegation signer digest algorithm. This value must follow the guidelines provided by RFC-8624 Section 3.3.

key_signing_keys[].digest_value

A cryptographic digest of a DNSKEY resource record (RR). DNSKEY records are used to publish the public key that resolvers can use to verify DNSSEC signatures that are used to secure certain kinds of information provided by the DNS system.

key_signing_keys[].dnskey_record

A string that represents a DNSKEY record.

key_signing_keys[].ds_record

A string that represents a delegation signer (DS) record.

key_signing_keys[].flag

An integer that specifies how the key is used. For key-signing key (KSK), this value is always 257.

key_signing_keys[].key_tag

An integer used to identify the DNSSEC record for the domain name. The process used to calculate the value is described in RFC-4034 Appendix B.

key_signing_keys[].kms_arn

The Amazon resource name (ARN) used to identify the customer managed key in Key Management Service (KMS). The KmsArn must be unique for each key-signing key (KSK) in a single hosted zone.

You must configure the customer managed key as follows:

Status

Enabled

Key spec

ECC_NIST_P256

Key usage

Sign and verify

Key policy

The key policy must give permission for the following actions:

  • DescribeKey

  • GetPublicKey

  • Sign

The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:

  • "Service": "dnssec-route53.amazonaws.com"

For more information about working with the customer managed key in KMS, see Key Management Service concepts.

key_signing_keys[].last_modified_date

The last time that the key-signing key (KSK) was changed.

key_signing_keys[].name

A string used to identify a key-signing key (KSK). Name can include numbers, letters, and underscores (_). Name must be unique for each key-signing key in the same hosted zone.

key_signing_keys[].public_key

The public key, represented as a Base64 encoding, as required by RFC-4034 Page 5.

key_signing_keys[].signing_algorithm_mnemonic

A string used to represent the signing algorithm. This value must follow the guidelines provided by RFC-8624 Section 3.1.

key_signing_keys[].signing_algorithm_type

An integer used to represent the signing algorithm. This value must follow the guidelines provided by RFC-8624 Section 3.1.

key_signing_keys[].status

A string that represents the current key-signing key (KSK) status.

Status can have one of the following values:

ACTIVE

The KSK is being used for signing.

INACTIVE

The KSK is not being used for signing.

DELETING

The KSK is in the process of being deleted.

ACTION_NEEDED

There is a problem with the KSK that requires you to take action to resolve. For example, the customer managed key might have been deleted, or the permissions for the customer managed key might have been changed.

INTERNAL_FAILURE

There was an error during a request. Before you can continue to work with DNSSEC signing, including actions that involve this KSK, you must correct the problem. For example, you may need to activate or deactivate the KSK.

key_signing_keys[].status_message

The status message provided for the following key-signing key (KSK) statuses: ACTION_NEEDED or INTERNAL_FAILURE. The status message includes information about what the problem might be and steps that you can take to correct the issue.

status

A string representing the status of DNSSEC.

STRUCT(
    "serve_signature" VARCHAR,
    "status_message" VARCHAR
)
Show child fields
status.serve_signature

A string that represents the current hosted zone signing status.

Status can have one of the following values:

SIGNING

DNSSEC signing is enabled for the hosted zone.

NOT_SIGNING

DNSSEC signing is not enabled for the hosted zone.

DELETING

DNSSEC signing is in the process of being removed for the hosted zone.

ACTION_NEEDED

There is a problem with signing in the hosted zone that requires you to take action to resolve. For example, the customer managed key might have been deleted, or the permissions for the customer managed key might have been changed.

INTERNAL_FAILURE

There was an error during a request. Before you can continue to work with DNSSEC signing, including with key-signing keys (KSKs), you must correct the problem by enabling or disabling DNSSEC signing for the hosted zone.

status.status_message

The status message provided for the following DNSSEC signing status: INTERNAL_FAILURE. The status message includes information about what the problem might be and steps that you can take to correct the issue.