Deletehostedzone

​

Event Information

• The DeleteHostedZone event in AWS Route53 refers to the deletion of a hosted zone, which is a container for DNS records that define how traffic is routed for a domain or subdomain.
• This event indicates that a specific hosted zone has been deleted, and all associated DNS records and configurations within that zone have been removed.
• It is important to note that deleting a hosted zone is a permanent action and cannot be undone, so caution should be exercised when performing this operation.

​

Examples

• Unauthorized deletion: If proper access controls and permissions are not in place, an unauthorized user may be able to delete a hosted zone in Route53. This can lead to a loss of DNS records and disruption of services.
• Data loss: Deleting a hosted zone in Route53 will result in the loss of all DNS records associated with that zone. If these records are not backed up or if there is no recovery plan in place, it can lead to data loss and service downtime.
• Impact on dependent services: Deleting a hosted zone can have a cascading effect on other services that rely on DNS resolution. This can result in service disruptions or failures for applications, websites, or other resources that depend on the DNS records within the deleted zone.

​

Remediation

​

Using Console

1. Enable DNSSEC for Route53:
   • Open the AWS Management Console and navigate to the Route53 service.
   • Select the hosted zone for which you want to enable DNSSEC.
   • Click on the “Enable DNSSEC” button.
   • Follow the on-screen instructions to complete the DNSSEC setup process.
2. Implement VPC DNS resolution for Route53:
   • Open the AWS Management Console and go to the VPC service.
   • Select the VPC for which you want to enable DNS resolution with Route53.
   • Click on the “Actions” button and choose “Edit DNS resolution”.
   • Select the “Enable DNS resolution” option and choose the Route53 Resolver endpoint from the dropdown menu.
   • Click on the “Save” button to apply the changes.
3. Enable query logging for Route53:
   • Open the AWS Management Console and navigate to the Route53 service.
   • Select the hosted zone for which you want to enable query logging.
   • Click on the “Create query logging configuration” button.
   • Provide a name for the configuration and select the desired CloudWatch Logs group to store the logs.
   • Choose the log format and click on the “Create” button to enable query logging.

​

Using CLI

1. Example 1: Ensure DNSSEC is enabled for a hosted zone:
   • Use the aws route53 get-hosted-zone command to retrieve the hosted zone ID.
   • Run the aws route53 update-hosted-zone command with the --dnssec-config parameter to enable DNSSEC for the hosted zone.
2. Example 2: Ensure DNS query logging is enabled for a hosted zone:
   • Use the aws route53 get-hosted-zone command to get the hosted zone ID.
   • Run the aws route53 create-query-logging-config command to create a query logging configuration.
   • Use the aws route53 associate-query-logging-config command to associate the query logging configuration with the hosted zone.
3. Example 3: Ensure DNSSEC is enabled for a domain:
   • Use the aws route53domains get-domain-detail command to retrieve the domain details.
   • Run the aws route53domains enable-domain-dnssec command to enable DNSSEC for the domain.

​

Using Python

1. Example 1: Updating DNS record TTL:

import boto3

def update_record_ttl(zone_id, record_name, new_ttl):
    client = boto3.client('route53')
    response = client.list_resource_record_sets(HostedZoneId=zone_id)
    
    for record_set in response['ResourceRecordSets']:
        if record_set['Name'] == record_name:
            record_set['TTL'] = new_ttl
            response = client.change_resource_record_sets(
                HostedZoneId=zone_id,
                ChangeBatch={
                    'Changes': [
                        {
                            'Action': 'UPSERT',
                            'ResourceRecordSet': record_set
                        }
                    ]
                }
            )
            print(f"Updated TTL for {record_name} to {new_ttl}")
            break

2. Example 2: Creating a new DNS record:

import boto3

def create_dns_record(zone_id, record_name, record_type, record_value):
    client = boto3.client('route53')
    response = client.change_resource_record_sets(
        HostedZoneId=zone_id,
        ChangeBatch={
            'Changes': [
                {
                    'Action': 'CREATE',
                    'ResourceRecordSet': {
                        'Name': record_name,
                        'Type': record_type,
                        'TTL': 300,
                        'ResourceRecords': [
                            {
                                'Value': record_value
                            }
                        ]
                    }
                }
            ]
        }
    )
    print(f"Created DNS record: {record_name} ({record_type}) with value {record_value}")

3. Example 3: Deleting a DNS record:

import boto3

def delete_dns_record(zone_id, record_name, record_type):
    client = boto3.client('route53')
    response = client.list_resource_record_sets(HostedZoneId=zone_id)
    
    for record_set in response['ResourceRecordSets']:
        if record_set['Name'] == record_name and record_set['Type'] == record_type:
            response = client.change_resource_record_sets(
                HostedZoneId=zone_id,
                ChangeBatch={
                    'Changes': [
                        {
                            'Action': 'DELETE',
                            'ResourceRecordSet': record_set
                        }
                    ]
                }
            )
            print(f"Deleted DNS record: {record_name} ({record_type})")
            break