Route 53 Domains

eventName	Description	Sample	Rule
any	Catch-all entry for Route 53 Domains rules that match the service but not a specific eventName.	N	N
DisableDomainTransferLock	Removes the transfer lock from a registered domain to allow it to be transferred to a different registrar.	Y	Y
TransferDomainToAnotherAwsAccount	Transfers a domain registered with Route 53 Domains from the current AWS account to another AWS account.	N	Y
AcceptDomainTransferFromAnotherAwsAccount	Accepts the transfer of a domain from another Amazon Web Services account to the currentAmazon Web Services account.	N	N
AssociateDelegationSignerToDomain	Creates a delegation signer (DS) record in the registry zone for this domain name.	N	N
CancelDomainTransferToAnotherAwsAccount	Cancels the transfer of a domain from the current Amazon Web Services account to another Amazon Web Services account.	N	N
CheckDomainAvailability	This operation checks the availability of one domain name.	N	N
CheckDomainTransferability	Checks whether a domain name can be transferred to Amazon Route 53.	N	N
DeleteDomain	This operation deletes the specified domain.	N	N
DeleteTagsForDomain	This operation deletes the specified tags for a domain.	N	N
DisableDomainAutoRenew	This operation disables automatic renewal of domain registration for the specified domain.	N	N
DisassociateDelegationSignerFromDomain	Deletes a delegation signer (DS) record in the registry zone for this domain name.	N	N
EnableDomainAutoRenew	This operation configures Amazon Route 53 to automatically renew the specified domain before the domain registration expires.	N	N
EnableDomainTransferLock	This operation sets the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers.	N	N
GetContactReachabilityStatus	For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation returns information about whether the registrant contact has responded.	Y	N
GetDomainDetail	This operation returns detailed information about a specified domain that is associated with the current Amazon Web Services account.	N	N
GetDomainSuggestions	The GetDomainSuggestions operation returns a list of suggested domain names.	N	N
GetOperationDetail	This operation returns the current status of an operation that is not completed.	N	N
ListDomains	This operation returns all the domain names registered with Amazon Route 53 for the current Amazon Web Services account if no filtering conditions are used.	Y	N
ListOperations	Returns information about all of the operations that return an operation ID and that have ever been performed on domains that were registered by the current account.	Y	N
ListPrices	Lists the following prices for either all the TLDs supported by Route 53, or the specified TLD: Registration Transfer Owner change Domain renewal Domain restoration	N	N
ListTagsForDomain	This operation returns all of the tags that are associated with the specified domain.	N	N
PushDomain	Moves a domain from Amazon Web Services to another registrar.	N	N
RegisterDomain	This operation registers a domain.	N	N
RejectDomainTransferFromAnotherAwsAccount	Rejects the transfer of a domain from another Amazon Web Services account to the current Amazon Web Services account.	N	N
RenewDomain	This operation renews a domain for the specified number of years.	N	N
ResendContactReachabilityEmail	For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation resends the confirmation email to the current email address for the registrant contact.	N	N
ResendOperationAuthorization	Resend the form of authorization email for this operation.	N	N
RetrieveDomainAuthCode	This operation returns the authorization code for the domain.	N	N
TransferDomain	Transfers a domain from another registrar to Amazon Route 53.	N	N
UpdateDomainContact	This operation updates the contact information for a particular domain.	N	N
UpdateDomainContactPrivacy	This operation updates the specified domain contact's privacy setting.	N	N
UpdateDomainNameservers	This operation replaces the current set of name servers for the domain with the specified set of name servers.	N	N
UpdateTagsForDomain	This operation adds or updates tags for a specified domain.	N	N
ViewBilling	Returns all the domain-related billing records for the current Amazon Web Services account for a specified period	Y	N

any: Route 53 Domains (catch-all)

Service: route53domains

Description

Catch-all entry for Route 53 Domains rules that match the service but not a specific eventName.

DisableDomainTransferLock

Service: route53domains

Description

Removes the transfer lock from a registered domain to allow it to be transferred to a different registrar.

Example CloudTrail Event #

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:58:22Z",
  "eventSource": "route53domains.amazonaws.com",
  "eventName": "DisableDomainTransferLock",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#route53domains.disable-domain-transfer-lock",
  "errorCode": "UnsupportedTLD",
  "errorMessage": "The invalid TLD is not supported",
  "requestParameters": {
    "domainName": "dw-harn-eb7866.invalid"
  },
  "responseElements": null,
  "requestID": "722fc6b2-8574-4d67-be1e-753002d0790b",
  "eventID": "2c886ede-967a-4877-901a-a79d48f586fa",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "route53domains.us-east-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS Route 53 Domain Transfer Lock Disabled source low: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.T1098

TransferDomainToAnotherAwsAccount

Service: route53domains

Description

Transfers a domain registered with Route 53 Domains from the current AWS account to another AWS account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS Route 53 Domain Transferred to Another Account source low: Detects when a request has been made to transfer a Route 53 domain to another AWS account.T1098

AcceptDomainTransferFromAnotherAwsAccount

Service: route53domains

Description

Accepts the transfer of a domain from another Amazon Web Services account to the currentAmazon Web Services account.

AssociateDelegationSignerToDomain

Service: route53domains

Description

Creates a delegation signer (DS) record in the registry zone for this domain name.

CancelDomainTransferToAnotherAwsAccount

Service: route53domains

Description

Cancels the transfer of a domain from the current Amazon Web Services account to another Amazon Web Services account.

CheckDomainAvailability

Service: route53domains

Description

This operation checks the availability of one domain name.

CheckDomainTransferability

Service: route53domains

Description

Checks whether a domain name can be transferred to Amazon Route 53.

DeleteDomain

Service: route53domains

Description

This operation deletes the specified domain.

DeleteTagsForDomain

Service: route53domains

Description

This operation deletes the specified tags for a domain.

DisableDomainAutoRenew

Service: route53domains

Description

This operation disables automatic renewal of domain registration for the specified domain.

DisassociateDelegationSignerFromDomain

Service: route53domains

Description

Deletes a delegation signer (DS) record in the registry zone for this domain name.

EnableDomainAutoRenew

Service: route53domains

Description

This operation configures Amazon Route 53 to automatically renew the specified domain before the domain registration expires.

EnableDomainTransferLock

Service: route53domains

Description

This operation sets the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers.

GetContactReachabilityStatus

Service: route53domains

Description

For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation returns information about whether the registrant contact has responded.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: route53domains:GetContactReachabilityStatus on resource: *",
  "eventID": "3ad2cdf3-1541-4ddb-b1a8-ed896e7c30c0",
  "eventName": "GetContactReachabilityStatus",
  "eventSource": "route53domains.amazonaws.com",
  "eventTime": "2019-07-25T09:41:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "d38f8427-9fd7-4116-9960-613d125fd766",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetDomainDetail

Service: route53domains

Description

This operation returns detailed information about a specified domain that is associated with the current Amazon Web Services account.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.08",
  "eventID": "c0417ac1-6e24-4a7b-bfe7-b24f2d11fe14",
  "eventSource": "route53domains.amazonaws.com",
  "eventName": "GetDomainDetail",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "feaf21f1-28fa-4a92-a613-94d7755da6b1",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

GetDomainSuggestions

Service: route53domains

Description

The GetDomainSuggestions operation returns a list of suggested domain names.

GetOperationDetail

Service: route53domains

Description

This operation returns the current status of an operation that is not completed.

Example CloudTrail Event #

{
  "eventVersion": "1.08",
  "eventID": "d217bae2-a121-48ad-a3a7-e455f3a04e16",
  "eventSource": "route53domains.amazonaws.com",
  "eventName": "GetOperationDetail",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "cc3a815c-e04f-4c9a-9575-a34ae17db435",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

ListDomains

Service: route53domains

Description

This operation returns all the domain names registered with Amazon Route 53 for the current Amazon Web Services account if no filtering conditions are used.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "e8c8e7df-29dd-4749-84dd-407447a4c322",
  "eventName": "ListDomains",
  "eventSource": "route53domains.amazonaws.com",
  "eventTime": "2021-04-13T13:18:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "760111141337",
  "requestID": "19dcd476-739f-4944-aabf-59a908a8abf0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "AWS Internal",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIAJH2MJ276K7KSTPQA",
    "accountId": "760111141337",
    "arn": "arn:aws:iam::760111141337:user/cloudmapper",
    "invokedBy": "AWS Internal",
    "principalId": "AIDAYTOGP2RLK32EB7QZV",
    "sessionContext": {
      "attributes": {
        "creationDate": "2021-04-13T13:18:39Z",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "cloudmapper"
  }
}

References #

Sample log: splunk/attack_data

ListOperations

Service: route53domains

Description

Returns information about all of the operations that return an operation ID and that have ever been performed on domains that were registered by the current account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "a47a05ae-af50-4ff9-a4fd-08dc0873bec0",
  "eventName": "ListOperations",
  "eventSource": "route53domains.amazonaws.com",
  "eventTime": "2020-08-06T15:57:34Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "26f0af40-569e-4510-8dd6-10ba59183edf",
  "requestParameters": {
    "createdSince": "Jul 22, 2020 3:57:33 PM",
    "maxItems": 100
  },
  "responseElements": null,
  "sourceIPAddress": "252.1.22.60",
  "userAgent": "Coral/Jakarta",
  "userIdentity": {
    "accessKeyId": "ASIAZZEZ7STHKNW2G6FE",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "principalId": "811596193553",
    "sessionContext": {
      "attributes": {
        "creationDate": "2020-08-06T15:57:23Z",
        "mfaAuthenticated": "true"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "Root",
    "userName": "flaws"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListPrices

Service: route53domains

Description

Lists the following prices for either all the TLDs supported by Route 53, or the specified TLD: Registration Transfer Owner change Domain renewal Domain restoration

ListTagsForDomain

Service: route53domains

Description

This operation returns all of the tags that are associated with the specified domain.

Example CloudTrail Event #

{
  "eventVersion": "1.08",
  "eventID": "64da68fd-abeb-4f8f-a152-9caa0424c0cb",
  "eventSource": "route53domains.amazonaws.com",
  "eventName": "ListTagsForDomain",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "c4916064-d1b4-4bd5-8a57-53c30d26285d",
  "userAgent": "Botocore/1.35.95 ua/2.0 os/linux#5.10.245-245.983.amzn2.x86_64 md/arch#x86_64 lang/python#3.9.23 md/pyimpl#CPython cfg/retry-mode#standard",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "example.us-east-1.amazonaws.com"
  }
}

PushDomain

Service: route53domains

Description

Moves a domain from Amazon Web Services to another registrar.

RegisterDomain

Service: route53domains

Description

This operation registers a domain.

RejectDomainTransferFromAnotherAwsAccount

Service: route53domains

Description

Rejects the transfer of a domain from another Amazon Web Services account to the current Amazon Web Services account.

RenewDomain

Service: route53domains

Description

This operation renews a domain for the specified number of years.

ResendContactReachabilityEmail

Service: route53domains

Description

For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation resends the confirmation email to the current email address for the registrant contact.

ResendOperationAuthorization

Service: route53domains

Description

Resend the form of authorization email for this operation.

RetrieveDomainAuthCode

Service: route53domains

Description

This operation returns the authorization code for the domain.

TransferDomain

Service: route53domains

Description

Transfers a domain from another registrar to Amazon Route 53.

UpdateDomainContact

Service: route53domains

Description

This operation updates the contact information for a particular domain.

UpdateDomainContactPrivacy

Service: route53domains

Description

This operation updates the specified domain contact's privacy setting.

UpdateDomainNameservers

Service: route53domains

Description

This operation replaces the current set of name servers for the domain with the specified set of name servers.

UpdateTagsForDomain

Service: route53domains

Description

This operation adds or updates tags for a specified domain.

ViewBilling

Service: route53domains

Description

Returns all the domain-related billing records for the current Amazon Web Services account for a specified period

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: route53domains:ViewBilling on resource: *",
  "eventID": "65987f52-0c88-4c0c-a201-1a06b62aa619",
  "eventName": "ViewBilling",
  "eventSource": "route53domains.amazonaws.com",
  "eventTime": "2019-11-04T00:04:12Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "644146c4-2f0b-40c7-a858-f76f6d7390d4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "95.22.6.8",
  "userAgent": "Boto3/1.10.8 Python/3.7.5rc1 Linux/5.2.0-kali3-amd64 Botocore/1.13.8",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs