Route53 Query Logging Controller automates DNS query logging across multiple AWS accounts using EKS, cross-account IAM roles, and ServiceAccount Pod Identity. The control plane in Account 1 runs a KRO controller that manages ResolverQueryLogConfig custom resources, which trigger cross-account AssumeRole chains to Client Accounts A and B, enabling centralized CloudWatch Logs collection from Route53 Resolver. This pattern eliminates manual DNS logging setup, enforces consistent logging policies via CRDs, and scales to dozens of spoke accounts without credential sprawl. Fork this diagram on Diagrams.so to customize account IDs, VPC CIDRs, or log group naming for your organization. The design demonstrates least-privilege cross-account access using Pod Identity and trust relationships, making it ideal for enterprises standardizing DNS observability across business units.