Stale dns entry ip address takeover

The attacker can't choose which IPs they get. In very general terms, without familiarity with your case, chances are they wouldn't be after you specifically but probably in the business of hijacking similar setups of many customers. They wouldn't need to go to a lot of effort to get just the IP you were using, but instead they would simply start grabbing whatever IPs they randomly got assigned to them, in the hopes of finding customers who had useful DNS names pointing to them.

In general terms, when we run websites in AWS with security in mind, we don't expose EC2 instances (VMs) directly to the internet with public, static or long-term IPs. AWS has a security posture assessment service called AWS Security Hub that even explicitly checks for this and advises against it: https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-9

Instead, we would place our EC2 instances, container tasks, or other compute capacity hosting our service behind an Application Load Balancer (ALB). We could further place a CloudFront distribution in front of the ALB, but to keep this concise, I'll just talk about the ALB. We would configure alias records in a Route 53 hosted zone or CNAME records in a third-party DNS service to make our own, customer-specific DNS names aliases that point to the AWS-managed DNS name for the ALB.

When we later deleted the ALB, releasing its IP addresses for use by other AWS customers, our DNS names will immediately stop pointing to them, because AWS's automation deletes the AWS-managed DNS records where our DNS names are still pointing. In effect, our custom DNS name will no longer point to any IP, because the ALB to which our alias record is pointing doesn't exist.

Incidentally, an ALB changes its IP addresses relatively frequently, so we would quickly notice if we made the mistake of configuring our DNS names to point to the individual IPs of the ALB. This would help to ensure that when we delete the resource, we won't accidentally be left with DNS names pointing to IP addresses reassigned to others.