Unrestricted DNS Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP and UDP port 53 (DNS).Risk Level
MediumAddress
SecurityCompliance Standards
HIPAA, AWSWAF, GDPR, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted DNS access issue in AWS, you can follow the below steps:
- Login to the AWS console and navigate to the Route 53 service.
- Click on the Hosted Zones option in the left-hand menu.
- Select the hosted zone for which you want to restrict DNS access.
- Click on the “Create Record Set” button to create a new record set.
- In the “Name” field, enter the domain name for which you want to restrict DNS access.
- In the “Type” field, select the appropriate DNS record type (such as A, CNAME, etc.).
- In the “Value” field, enter the IP address or domain name of the resource that the DNS record should point to.
- Scroll down to the “Routing Policy” section and select “Simple” routing policy.
- In the “Alias” section, select “No” to disable the alias feature.
- Click on the “Create” button to create the record set.
Using CLI
Using CLI
To remediate the unrestricted DNS access issue in AWS using AWS CLI, follow these steps:
- Open the AWS CLI on your local machine.
-
Run the following command to list all the Route 53 hosted zones in your account:
- Identify the hosted zone that has unrestricted DNS access and make a note of its ID.
-
Run the following command to update the hosted zone to restrict DNS access:
Note: Replace
<hosted-zone-id>with the ID of the hosted zone identified in step 3. -
Run the following command to verify that the hosted zone has been updated:
Note: Replace
<hosted-zone-id>with the ID of the hosted zone identified in step 3. - Verify that the DNS access has been restricted by checking the DNS settings in the AWS Management Console. Note: The DNS access should now be restricted to authorized users only.
Using Python
Using Python
To remediate the unrestricted DNS access misconfiguration in AWS using Python, you can follow these steps:Note: This code only removes the record sets that match the criteria mentioned in step 4. You may want to modify it to suit your specific requirements. Also, make sure to test the code thoroughly before running it in a production environment.
- Connect to the AWS account using the Boto3 library in Python.
- Get a list of all Route53 hosted zones using the
list_hosted_zones()method. - For each hosted zone, get a list of all the record sets using the
list_resource_record_sets()method. - Check each record set for any entries that have an empty or wildcard
Namefield and anAorCNAMErecord type. - If any such record sets are found, remove them using the
change_resource_record_sets()method.