More Info:
Ensure that Cloud DNS Managed Zones use key signing key.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “GCP DNS Managed Zones Should Use Key Signing Key” for GCP using GCP console, please follow the below steps:
- Login to your GCP console.
- Navigate to the Cloud DNS page by clicking on the Navigation menu > Network services > Cloud DNS.
- Select the DNS zone that you want to remediate.
- Click on the “DNSSEC” tab.
- Check if the DNSSEC is enabled or not. If not, click on the “Enable DNSSEC” button.
- Once the DNSSEC is enabled, you will see the Key Signing Key (KSK) and Zone Signing Key (ZSK) options.
- Click on the “Add KSK” button to add a new Key Signing Key.
- Enter the required details like algorithm type, key size, and description.
- Click on the “Create” button to create a new KSK.
- Once the KSK is created, you will see it in the list of KSKs.
- Now, select the KSK that you have just created and click on the “Activate” button to activate it.
- Once the KSK is activated, it will be used for signing the DNS records in the managed zone.
Using CLI
Using CLI
To remediate the GCP DNS Managed Zones Should Use Key Signing Key misconfiguration using GCP CLI, follow these steps:
- Open the Google Cloud Console and select the project where you want to remediate the misconfiguration.
- Open the Cloud Shell by clicking on the icon in the top right corner of the console.
-
Run the following command to list all the managed zones in the project:
- Identify the managed zone that needs to be remediated and note down its name.
-
Run the following command to update the managed zone to use a key signing key:
Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you identified in step 4, and [ALGORITHM] with the key signing algorithm that you want to use (e.g. “rsasha256”).
-
Verify that the managed zone has been updated by running the following command:
This command should display the updated DNSSEC state, key type and algorithm for the managed zone.
Using Python
Using Python
To remediate the misconfiguration “GCP DNS Managed Zones Should Use Key Signing Key”, we need to perform the following steps:Step 1: Create a new Key Signing Key (KSK) in Cloud DNSStep 2: Update the DNSSEC configuration of the Managed Zone to use the new KSKStep 3: Wait for the DNSSEC configuration to propagateDNSSEC changes can take up to 24 hours to propagate, so we need to wait for the changes to take effect.That’s it! The DNS Managed Zone in GCP should now be using a Key Signing Key.