Aws/dns Observation
Observe Route53 hosted zones, record sets, and detect orphaned DNS records pointing at decommissioned infrastructure.
This model reads Route53 data for observation and cross-references record targets against inventory/adopt data to find orphaned entries. It does not manage zones or records — use @swamp/aws/route53 for infrastructure management.
Quick Start
swamp extension pull @webframp/aws/dns-observation
swamp model create @webframp/aws/dns-observation aws-dns-observation
swamp model method run aws-dns-observation list_zones
swamp model method run aws-dns-observation list_records
swamp model method run aws-dns-observation detect_orphansMethods
- list_zones — List all hosted zones with record counts and metadata
- list_records — List all record sets across zones (primary drift-state output)
- detect_orphans — Cross-reference records against inventory to find orphans
Prerequisites
Route53 read access. Required IAM permissions:
- route53:ListHostedZones
- route53:GetHostedZone
- route53:ListResourceRecordSets
- sts:GetCallerIdentity
For orphan detection, upstream models must have fresh data:
- @webframp/aws/inventory (scan spec) — EC2 IPs, ELBs, S3, CloudFront
- @webframp/aws/adopt (discovery spec) — Elastic IPs
2026.08.21.1
Changed: Route53/STS API failures across list_zones, list_records,
and detect_orphans now raise or log an error naming the failing operation
(GetCallerIdentity, ListHostedZones, GetHostedZone,
ListResourceRecordSets) plus the relevant zone ID or page number, instead of
either propagating a raw SDK error with no context or, in the case of
non-critical lookups, swallowing the failure silently.
Changed: Warnings for missing upstream data in detect_orphans (stored
record scan, inventory data, adopt data) now include the underlying error
message instead of a generic "could not read" note with no detail.
Changed: inventoryModelName and adoptModelName on detect_orphans
now require non-empty strings instead of accepting an empty string that would
silently fail to match any stored data.
Global Arguments
| Argument | Type | Description |
|---|---|---|
| region | string | AWS region (Route53 is global but STS needs a region) |
| Argument | Type | Description |
|---|---|---|
| includePrivate? | boolean | Include private hosted zones in results |
| Argument | Type | Description |
|---|---|---|
| zoneFilter? | array | Limit to specific zone IDs. Omit for all zones. |
| typeFilter? | array | Limit to specific record types (A, AAAA, CNAME, etc.) |
| Argument | Type | Description |
|---|---|---|
| inventoryModelName? | string | Name of the @webframp/aws/inventory model instance |
| adoptModelName? | string | Name of the @webframp/aws/adopt model instance |
| skipTypes? | array | Record types to skip during orphan detection |
Resources
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (3 packages)
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.30.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.30.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.07.30.1
Added: Optional profile global argument for multi-account credential resolution.
When set, credentials resolve via fromIni (supports SSO token cache and shared-config
profiles). When omitted, the default credential chain applies as before. Fully backward
compatible — no changes required for existing instances.
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (2 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.21.1
Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).
Upgrade note: No behavioral changes. Routine dependency maintenance.
2026.07.18.2
Added: An upgrades array entry (no-op) to dns_observation.ts for proper
typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-route-53 and @aws-sdk/client-sts from
3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.
@webframp/aws/dns-observation v2026.07.03.1
Changed: Added JSDoc documentation to the model export for improved
deno doc and quality rubric compliance.
Initial release.
Methods
- list_zones — List all Route53 hosted zones with record counts, public/private status, and VPC associations
- list_records — List all record sets across zones with pagination support
- detect_orphans — Cross-reference DNS record targets against inventory/adopt data to find orphaned entries pointing at decommissioned infrastructure
Orphan Detection
Identifies DNS records pointing at resources no longer present in inventory:
- ELB aliases not found in inventory
- CloudFront aliases not found in inventory
- S3 website endpoints not found in inventory
- A record IPs not found in EC2 public IPs or Elastic IPs
- CNAME targets pointing at missing ELBs or S3 buckets
Excludes RFC 1918, loopback, and link-local addresses from IP checks. Reports
truncated: true when pagination limits are reached.
2026.07.18.1
Changed: Bumped @aws-sdk/client-route-53 and @aws-sdk/client-sts from
3.1069.0 to 3.1090.0 for dependency freshness. No behavior change.
@webframp/aws/dns-observation v2026.07.03.1
Changed: Added JSDoc documentation to the model export for improved
deno doc and quality rubric compliance.
Initial release.
Methods
- list_zones — List all Route53 hosted zones with record counts, public/private status, and VPC associations
- list_records — List all record sets across zones with pagination support
- detect_orphans — Cross-reference DNS record targets against inventory/adopt data to find orphaned entries pointing at decommissioned infrastructure
Orphan Detection
Identifies DNS records pointing at resources no longer present in inventory:
- ELB aliases not found in inventory
- CloudFront aliases not found in inventory
- S3 website endpoints not found in inventory
- A record IPs not found in EC2 public IPs or Elastic IPs
- CNAME targets pointing at missing ELBs or S3 buckets
Excludes RFC 1918, loopback, and link-local addresses from IP checks. Reports
truncated: true when pagination limits are reached.
@webframp/aws/dns-observation v2026.07.03.1
Changed: Added JSDoc documentation to the model export for improved
deno doc and quality rubric compliance.
Initial release.
Methods
- list_zones — List all Route53 hosted zones with record counts, public/private status, and VPC associations
- list_records — List all record sets across zones with pagination support
- detect_orphans — Cross-reference DNS record targets against inventory/adopt data to find orphaned entries pointing at decommissioned infrastructure
Orphan Detection
Identifies DNS records pointing at resources no longer present in inventory:
- ELB aliases not found in inventory
- CloudFront aliases not found in inventory
- S3 website endpoints not found in inventory
- A record IPs not found in EC2 public IPs or Elastic IPs
- CNAME targets pointing at missing ELBs or S3 buckets
Excludes RFC 1918, loopback, and link-local addresses from IP checks. Reports
truncated: true when pagination limits are reached.
@webframp/aws/dns-observation v2026.06.27.2
Initial release.
Methods
- list_zones — List all Route53 hosted zones with record counts, public/private status, and VPC associations
- list_records — List all record sets across zones with pagination support
- detect_orphans — Cross-reference DNS record targets against inventory/adopt data to find orphaned entries pointing at decommissioned infrastructure
Orphan Detection
Identifies DNS records pointing at resources no longer present in inventory:
- ELB aliases not found in inventory
- CloudFront aliases not found in inventory
- S3 website endpoints not found in inventory
- A record IPs not found in EC2 public IPs or Elastic IPs
- CNAME targets pointing at missing ELBs or S3 buckets
Excludes RFC 1918, loopback, and link-local addresses from IP checks. Reports
truncated: true when pagination limits are reached.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned