Route 53 Resolver query logs are AWS DNS logs that record domain-name lookups made from specified VPCs and, in some cases, related resolver endpoints. They show which host or workload asked for a name, what name was queried, and when the lookup happened. They do not reveal the full contents of traffic, but they expose the DNS layer that often comes before an outbound connection.
These logs matter because DNS is a common control point in cloud attacks and defenses. An attacker may use DNS to locate internal services, reach command-and-control infrastructure, or support data theft through suspicious external domains. Defenders use query logs to spot unusual lookup patterns, rare domains, failed resolutions, and connections that do not fit the environment’s baseline. When correlated with CloudTrail and VPC Flow Logs, Route 53 Resolver query logs can help reconstruct how an intrusion moved through discovery, access, and possible exfiltration.