AWSAmazon Route 53Networking

`aws_route53_query_log` cost estimation

Enables DNS query logging for a Route 53 public hosted zone. The logging config is free, but every query it records is written to CloudWatch Logs, which bills for ingestion and storage.

The aws_route53_query_log resource turns on public DNS query logging for a Route 53 hosted zone, sending a log record for each DNS query the zone answers to an Amazon CloudWatch Logs log group. Enabling the config is free, Route 53 does not charge for the query logging feature itself.

The cost is downstream in CloudWatch Logs. Every logged query becomes log data that CloudWatch bills on ingestion (about 0.50 dollars per GB ingested in us-east-1) and on storage (about 0.03 dollars per GB-month for logs retained). For a busy public zone answering millions of queries a day, the log volume adds up: DNS query records are small individually, but high query rates on a popular domain can push ingestion into gigabytes per day. If you then run CloudWatch Logs Insights queries over that data, those scans bill about 0.005 dollars per GB scanned, and any subscription filter that streams the logs onward to a destination adds that destination's cost.

This is the classic free-resource-with-a-metered-tail pattern: the switch is free, the data plane it feeds is not. The mitigations are all about controlling how much log data you keep and for how long. Set a finite retention period on the CloudWatch log group (the default is never expire, which quietly accumulates storage cost forever). If you need long-term retention for analysis, export to S3 where storage is roughly ten times cheaper than CloudWatch Logs, or send to S3 via a subscription filter and query with Athena.

A few scoping notes. Public zone query logging via aws_route53_query_log only captures queries answered by Route 53's public resolvers, not queries from inside a VPC to private zones (for that, Resolver query logging is a separate feature). And the log group must be in us-east-1 for public hosted zone query logging, regardless of where the rest of your infrastructure lives.

c3x reports aws_route53_query_log as free and attributes the real spend to the aws_cloudwatch_log_group it writes to, based on expected query volume and retention.

Terraform example

A minimal but realistic configuration that C3X can estimate.

# Query logging for public hosted zones requires the log group in us-east-1.
resource "aws_cloudwatch_log_group" "dns" {
  name              = "/aws/route53/example.com"
  retention_in_days = 30 # cap retention so storage cost does not grow forever
}

resource "aws_route53_query_log" "example" {
  zone_id                  = aws_route53_zone.example.zone_id
  cloudwatch_log_group_arn = aws_cloudwatch_log_group.dns.arn
}

Pricing dimensions

What you actually pay for when you provision aws_route53_query_log.

Dimension	Unit	What's being charged
Route 53 query logging config	free	Enabling DNS query logging is free. Route 53 does not charge for the feature. $0 (free)
CloudWatch Logs ingestion	per GB ingested	Every logged DNS query is ingested into CloudWatch Logs and billed by volume. $0.50 per GB ingested (us-east-1)
CloudWatch Logs storage	per GB-month	Retained log data billed monthly. Defaults to never expire unless you set retention. $0.03 per GB-month
Logs Insights queries (if used)	per GB scanned	Ad hoc analysis over the logs bills per gigabyte scanned. $0.005 per GB scanned

Optimization tips

Common ways to reduce aws_route53_query_log cost without changing the workload.

Always set a log group retention period

Avoids unbounded $0.03 per GB-month storage growth

CloudWatch log groups default to never expire, so DNS query logs accumulate storage cost indefinitely. Set retention_in_days to a value that matches your actual needs, often 30 to 90 days, to cap ongoing storage charges.

Export to S3 for long-term retention

~10x lower storage cost vs CloudWatch Logs

S3 storage is roughly ten times cheaper than CloudWatch Logs. If you need query history for months, ship logs to S3 via a subscription filter and query with Athena instead of paying CloudWatch storage rates.

Only log the zones that need it

Query logging on every zone multiplies ingestion cost. Enable it selectively on zones where DNS query visibility genuinely matters for security or debugging, and leave low-value zones unlogged.

Budget for query volume before enabling on a busy domain

A high-traffic public domain can generate gigabytes of query logs per day. Estimate expected query volume and multiply by the ingestion rate before turning logging on, so the CloudWatch bill is not a surprise.

FAQ

Does Route 53 query logging cost anything?

The logging configuration itself is free. The cost is in CloudWatch Logs, which bills about 0.50 dollars per GB to ingest the query records and about 0.03 dollars per GB-month to store them.

How large can DNS query logs get?

Individual records are small, but a busy public domain answering millions of queries a day can produce gigabytes of log data daily. On a low-traffic zone the cost is negligible; on a popular domain it can be a real CloudWatch line item.

Why does the log group have to be in us-east-1?

Public hosted zone query logging requires the destination CloudWatch log group to be in us-east-1, regardless of where your other resources live. This is an AWS requirement specific to Route 53 public zone logging.

How do I keep query logging affordable?

Set a finite retention period on the log group so storage does not grow forever, export to S3 for cheaper long-term retention, and enable logging only on the zones where you actually need query visibility.