AWS Route53 Public Zone with Private Records
A hosted zone is a container for records (An object in a hosted zone that you use to define how you want to route traffic for the domain or a subdomain), which include information about how you want to route traffic for a domain (such as example.com) and all of its subdomains (such as www.example.com, retail.example.com, and seattle.accounting.example.com). A hosted zone has the same name as the corresponding domain. A public hosted zone is a container that holds information about how you want to route traffic on the internet for a specific domain.It is best practice to avoid AWS Route 53 Public Hosted Zones containing DNS records for private IPs or resources within your AWS account to overcome information leakage of your internal network and resources.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: You can not convert a public hosted zone into a private hosted zone. So, it is recommended to create and configure a Private Hosted Zone to manage private IPs within your Virtual Private Cloud (VPC) as Amazon Route 53 service will only return your private DNS records when queried from within the associated VPC, and delete the associated public hosted zone once the Private hosted zone is configured with all the records.
To create a private hosted zone using the Route 53 console:
1.For each VPC that you want to associate with the Route 53 hosted zone, change the following VPC settings to true:
	'enableDnsHostnames'
	'enableDnsSupport'
For more information, see Updating DNS Support (http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html#vpc-dns-updating) for Your VPC in the Amazon VPC User Guide.
2. Sign in to the AWS console
3. Go to Route 53 console
4. If you are new to Route 53, choose Get Started Now under DNS Management. If you are already using Route 53, choose Hosted Zones in the navigation pane.
5. Choose 'Create Hosted Zone'
6. In the Create Private Hosted Zone pane, enter a domain name and, optionally, a comment.
For information about how to specify characters other than a-z, 0-9, and - (hyphen) and how to specify internationalized domain names, see DNS Domain Name Format (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DomainNameFormat.html).
7. In the Type list, choose Private Hosted Zone for Amazon VPC
8. In the VPC ID list, choose the VPC that you want to associate with the hosted zone. If you want to associate more than one VPC with the hosted zone, you can add VPCs after you create the hosted zone.
Note: If the console displays the following message, you are trying to associate a VPC with this hosted zone that has already been associated with another hosted zone that has an overlapping namespace, such as example.com and retail.example.com:
'A conflicting domain is already associated with the given VPC or Delegation Set.'
9. Choose Create
10. To associate more VPCs with the new hosted zone, perform the following steps:
	a. Choose Back to Hosted Zones.
	b. Choose the radio button for the hosted zone.
	c. In the right pane, in VPC ID, choose another VPC that you want to associate with the hosted zone.
	d. Choose Associate New VPC.
	e. Repeat steps c and d until you have associated all of the VPCs that you want to with the hosted zone.
For More Information : https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-creating.html

To delete a public hosted zone using the Route 53 console:
1. Sign into the AWS console
2. Go Route53 console
3. Confirm that the hosted zone that you want to delete contains only an NS and an SOA record. If it contains additional records, delete them:
	a. Choose the name of the hosted zone that you want to delete.
	b. On the Record Sets page, if the list of records includes any records for which the value of the Type column is something other than NS or SOA, choose the row, and choose Delete Record Set. To select multiple, consecutive records, choose the first row, press and hold the Shift key, and choose the last row. To select multiple, non-consecutive records, choose the first row, press and hold the Ctrl key, and choose the remaining rows. Note: If you created any NS records for subdomains in the hosted zone, delete those records, too.
	c. Choose Back to Hosted Zones
4. On the Hosted Zones page, choose the row for the hosted zone that you want to delete.
5. Choose Delete Hosted Zone.
6. Choose OK to confirm.
7. If you want to make the domain unavailable on the internet, we recommend that you transfer DNS service to a free DNS service and then delete the Route 53 hosted zone. This prevents future DNS queries from possibly being misrouted. If the domain is registered with Route 53, see Adding or Changing Name Servers and Glue Records for a Domain (https://docs.aws.amazon.com/Route53/latest DeveloperGuide/domain-name-servers-glue-records.html) for information about how to replace Route 53 nameservers with name servers for the new DNS service. If the domain is registered with another registrar, use the method provided by the registrar to change name servers for the domain.
For More Information : https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DeleteHostedZone.html.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-route53-list-hosted-zones' AND json.rule =  'hostedZone.config.privateZone is false and resourceRecordSet[*].type any equal A and (resourceRecordSet[*].resourceRecords[*].value any start with 10. or resourceRecordSet[*].resourceRecords[*].value any start with _IPAddress.inRange("172.%d",16,31) or resourceRecordSet[*].resourceRecords[*].value any start with 192.168.)'```