GCP DNS Managed Zones Should Use Key Signing Key

Using Console

To remediate the misconfiguration “GCP DNS Managed Zones Should Use Key Signing Key” for GCP using GCP console, please follow the below steps:

Login to your GCP console.
Navigate to the Cloud DNS page by clicking on the Navigation menu > Network services > Cloud DNS.
Select the DNS zone that you want to remediate.
Click on the “DNSSEC” tab.
Check if the DNSSEC is enabled or not. If not, click on the “Enable DNSSEC” button.
Once the DNSSEC is enabled, you will see the Key Signing Key (KSK) and Zone Signing Key (ZSK) options.
Click on the “Add KSK” button to add a new Key Signing Key.
Enter the required details like algorithm type, key size, and description.
Click on the “Create” button to create a new KSK.
Once the KSK is created, you will see it in the list of KSKs.
Now, select the KSK that you have just created and click on the “Activate” button to activate it.
Once the KSK is activated, it will be used for signing the DNS records in the managed zone.

This completes the remediation of the misconfiguration “GCP DNS Managed Zones Should Use Key Signing Key” for GCP using GCP console.

Using CLI

To remediate the GCP DNS Managed Zones Should Use Key Signing Key misconfiguration using GCP CLI, follow these steps:

Open the Google Cloud Console and select the project where you want to remediate the misconfiguration.
Open the Cloud Shell by clicking on the icon in the top right corner of the console.
Run the following command to list all the managed zones in the project:
gcloud dns managed-zones list
Identify the managed zone that needs to be remediated and note down its name.
Run the following command to update the managed zone to use a key signing key:
gcloud dns managed-zones update [MANAGED_ZONE_NAME] --dnssec-state on --ksk-key-signing-algorithm [ALGORITHM]
Replace [MANAGED_ZONE_NAME] with the name of the managed zone that you identified in step 4, and [ALGORITHM] with the key signing algorithm that you want to use (e.g. “rsasha256”).
Verify that the managed zone has been updated by running the following command:
gcloud dns managed-zones describe [MANAGED_ZONE_NAME] --format="table(dnssecConfig.state, dnssecConfig.defaultKeySpecs[0].keyType, dnssecConfig.defaultKeySpecs[0].algorithm)"
This command should display the updated DNSSEC state, key type and algorithm for the managed zone.

By following these steps, you should be able to remediate the GCP DNS Managed Zones Should Use Key Signing Key misconfiguration using GCP CLI.

Using Python

To remediate the misconfiguration “GCP DNS Managed Zones Should Use Key Signing Key”, we need to perform the following steps:Step 1: Create a new Key Signing Key (KSK) in Cloud DNS

from google.cloud import dns

client = dns.Client()

zone_name = "example.com."
zone = client.zone(zone_name)

ksk = zone.create_dnssec_key(
    key_type=dns.DnssecKeyAlgorithm.RSASHA256,
    key_length=2048,
    key_signing=True
)

print("Created KSK with ID: {}".format(ksk.id))

Step 2: Update the DNSSEC configuration of the Managed Zone to use the new KSK

from google.cloud import dns

client = dns.Client()

zone_name = "example.com."
zone = client.zone(zone_name)

dnssec_config = zone.dnssec_config
dnssec_config.state = dns.DnssecState.ON
dnssec_config.default_key_signing_key = ksk.id

zone.update(dnssec_config=dnssec_config)

Step 3: Wait for the DNSSEC configuration to propagateDNSSEC changes can take up to 24 hours to propagate, so we need to wait for the changes to take effect.

import time

time.sleep(3600) # Wait for 1 hour

That’s it! The DNS Managed Zone in GCP should now be using a Key Signing Key.

Using Terraform

resource "google_dns_managed_zone" "this" {
  name        = "MANAGED_ZONE_NAME"   # e.g. "prod-example-zone"
  dns_name    = "DNS_NAME."           # e.g. "example.com."
  description = "DESCRIPTION"

  project = "PROJECT_ID"

  # Enable DNSSEC and explicitly configure a Key Signing Key (KSK)
  dnssec_config {
    state = "on"

    # Key Signing Key (KSK)
    default_key_specs {
      key_type   = "keySigning"
      algorithm  = "rsasha256"  # match your org's standard/CLI remediation
      key_length = 2048
    }

    # Zone Signing Key (ZSK)
    default_key_specs {
      key_type   = "zoneSigning"
      algorithm  = "rsasha256"
      key_length = 1024
    }
  }
}

Enabling DNSSEC and adding a KSK updates the existing managed zone in place; it does not force resource replacement, but DNSSEC changes will propagate to resolvers and require DS records at your registrar for validation to work end-to-end.For verification, terraform plan should show an in-place update on google_dns_managed_zone.this, with dnssec_config.state changing from "off" (or null) to "on" and new default_key_specs blocks including one with key_type = "keySigning".

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

GCP DNS Managed Zones Should Use Key Signing Key

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: