F5 GTM didn't forward zone

After Trial and error

If we want GTM to Forward zone we need to edit option in named configuration with recursive yes; and allow-recursive {any;};

So user who send request to GTM will recursive to AWS correctly.

But this seem not practical because we have to recursive all user.

Is this method (allow-recursive any) create flaw in security ? or have any flaw or disadvantage ?

Can I allow-recursive option in zone file (not named configuration) to limit {recursive any}; to use only in this Forward zone ?

Thank you