Deletehealthcheck

​

Event Information

• The DeleteHealthCheck event in AWS Route53 refers to the deletion of a health check configuration for a specific resource or endpoint.
• This event indicates that the health check is no longer active and will no longer be used to monitor the health of the associated resource.
• It is important to note that deleting a health check does not automatically remove it from any associated DNS records or routing policies. Additional steps may be required to update these configurations accordingly.

​

Examples

• Unauthorized deletion: If security is impacted with DeleteHealthCheck in AWS Route53, an example could be an unauthorized user gaining access to the AWS account and deleting a health check. This could lead to disruption of services and potential downtime for the affected resources.
• Misconfiguration: Another example could be a misconfiguration in the access control policies for the health check. If the permissions are not properly set, it could allow unintended users or roles to delete health checks, compromising the security of the system.
• Insider threat: A third example could be an insider threat scenario where a trusted employee with access to the AWS account intentionally deletes a health check. This could be motivated by malicious intent or as an act of sabotage, causing disruption to the services relying on the health check.

​

Remediation

​

Using Console

1. Enable DNSSEC for Route53:
   • Open the AWS Management Console and navigate to the Route53 service.
   • Select the hosted zone for which you want to enable DNSSEC.
   • Click on the “Enable DNSSEC” button.
   • Follow the on-screen instructions to complete the DNSSEC setup process.
2. Implement VPC DNS resolution for Route53:
   • Open the AWS Management Console and go to the VPC service.
   • Select the VPC for which you want to enable DNS resolution with Route53.
   • Click on the “Actions” button and choose “Edit DNS resolution”.
   • Select the “Enable DNS resolution” option and choose the Route53 Resolver endpoint from the dropdown menu.
   • Click on the “Save” button to apply the changes.
3. Enable query logging for Route53:
   • Open the AWS Management Console and navigate to the Route53 service.
   • Select the hosted zone for which you want to enable query logging.
   • Click on the “Create query logging configuration” button.
   • Provide a name for the configuration and select the desired CloudWatch Logs group to store the logs.
   • Choose the desired log format and click on the “Create” button to create the query logging configuration.

​

Using CLI

1. Example 1: Ensure DNSSEC is enabled for a hosted zone:
   • Use the aws route53 get-hosted-zone command to retrieve the hosted zone details.
   • Check if the KeySigningKeys attribute is present in the response. If not, DNSSEC is not enabled.
   • Enable DNSSEC by using the aws route53 enable-hosted-zone-dnssec command, providing the hosted zone ID.
2. Example 2: Ensure DNS query logging is enabled for a hosted zone:
   • Use the aws route53 get-hosted-zone command to retrieve the hosted zone details.
   • Check if the QueryLoggingConfig attribute is present in the response. If not, query logging is not enabled.
   • Enable query logging by using the aws route53 create-query-logging-config command, providing the hosted zone ID and desired configuration.
3. Example 3: Ensure DNSSEC is enabled for a domain:
   • Use the aws route53domains get-domain-detail command to retrieve the domain details.
   • Check if the DNSSECStatus attribute is set to ENABLED. If not, DNSSEC is not enabled.
   • Enable DNSSEC by using the aws route53domains enable-domain-dnssec command, providing the domain name.

​

Using Python

1. Example 1: Updating DNS record TTL:

import boto3

def update_record_ttl(zone_id, record_name, new_ttl):
    client = boto3.client('route53')
    response = client.list_resource_record_sets(HostedZoneId=zone_id)
    
    for record_set in response['ResourceRecordSets']:
        if record_set['Name'] == record_name:
            record_set['TTL'] = new_ttl
            response = client.change_resource_record_sets(
                HostedZoneId=zone_id,
                ChangeBatch={
                    'Changes': [
                        {
                            'Action': 'UPSERT',
                            'ResourceRecordSet': record_set
                        }
                    ]
                }
            )
            print(f"Updated TTL for {record_name} to {new_ttl}")
            break

2. Example 2: Creating a new DNS record:

import boto3

def create_dns_record(zone_id, record_name, record_type, record_value):
    client = boto3.client('route53')
    response = client.change_resource_record_sets(
        HostedZoneId=zone_id,
        ChangeBatch={
            'Changes': [
                {
                    'Action': 'CREATE',
                    'ResourceRecordSet': {
                        'Name': record_name,
                        'Type': record_type,
                        'TTL': 300,
                        'ResourceRecords': [
                            {
                                'Value': record_value
                            }
                        ]
                    }
                }
            ]
        }
    )
    print(f"Created DNS record: {record_name} ({record_type}) with value {record_value}")

3. Example 3: Deleting a DNS record:

import boto3

def delete_dns_record(zone_id, record_name, record_type):
    client = boto3.client('route53')
    response = client.list_resource_record_sets(HostedZoneId=zone_id)
    
    for record_set in response['ResourceRecordSets']:
        if record_set['Name'] == record_name and record_set['Type'] == record_type:
            response = client.change_resource_record_sets(
                HostedZoneId=zone_id,
                ChangeBatch={
                    'Changes': [
                        {
                            'Action': 'DELETE',
                            'ResourceRecordSet': record_set
                        }
                    ]
                }
            )
            print(f"Deleted DNS record: {record_name} ({record_type})")
            break