Route53 Query Logging Controller automates DNS query logging for EKS workloads by reconciling ResolverQueryLogConfig custom resources and managing IAM roles through namespace selectors. The controller watches desired state from network templates, assumes an execution role, and configures Route53 Resolver to stream query logs to CloudWatch Logs and CloudTrail for audit compliance. This GitOps-driven approach eliminates manual Route53 logging setup across multi-tenant EKS clusters and enforces consistent DNS observability policies. Fork this diagram on Diagrams.so to customize role bindings, log destinations, or VPC associations for your platform architecture. The pattern demonstrates Kubernetes operator patterns applied to AWS networking infrastructure.