Route 53 Domain Should Expire In 30 Days

More Info:

All the domain names registered with AWS Route 53 or transferred to AWS Route 53 should be renewed 30 days before their validity period ends.

Risk Level

Medium

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the Route 53 Domain Expiry in 30 days issue in AWS using the AWS console, follow these steps:

1. Log in to your AWS Management Console.
2. Navigate to the Route 53 dashboard.
3. In the left-hand navigation panel, click on the “Registered domains” option.
4. Locate the domain that is expiring in 30 days and click on it.
5. Click on the “Renew registration” button.
6. Follow the prompts to renew the domain registration.
7. Once the domain registration is renewed, verify that the domain expiry date has been updated to a future date.

By following these steps, you will have successfully remediated the Route 53 Domain Expiry in 30 Days issue in AWS.

Using CLI

To remediate the Route 53 Domain Expiry in 30 Days misconfiguration for AWS using AWS CLI, follow these steps:

1. Install AWS CLI on your local machine if you haven’t already done so.

2. Open a terminal or command prompt and run the following command to list all hosted zones in your AWS account:

aws route53 list-hosted-zones

3. Identify the hosted zone that is expiring in 30 days or less. Note the value of the “Id” field for this hosted zone.

4. Run the following command to get the details of the hosted zone:

aws route53 get-hosted-zone --id <hosted-zone-id>

Replace <hosted-zone-id> with the actual ID of the hosted zone you identified in step 3.

5. Check the value of the “Expiration” field in the output of the previous command. If the value is less than 30 days from the current date, the hosted zone is expiring soon and needs to be renewed.

6. To renew the hosted zone, run the following command:

aws route53 update-hosted-zone --id <hosted-zone-id> --auto-renew

Replace <hosted-zone-id> with the actual ID of the hosted zone you identified in step 3.

7. Verify that the hosted zone has been renewed by running the following command:

aws route53 get-hosted-zone --id <hosted-zone-id>

Check the value of the “Expiration” field in the output of the previous command to ensure that it has been extended.

By following these steps, you can remediate the Route 53 Domain Expiry in 30 Days misconfiguration for AWS using AWS CLI.

Using Python

To remediate the Route 53 Domain Expiry in 30 days issue using Python, you can use the AWS SDK for Python (Boto3) to automate the process. Here are the steps:

1. Install Boto3: Install the Boto3 library using pip by running the following command in your terminal:

pip install boto3

2. Create an AWS IAM user: Create an IAM user with the necessary permissions to access Route 53 domains. The user should have the following permissions:

• route53domains:ListDomains
• route53domains:GetDomainDetail

3. Configure AWS credentials: Configure your AWS credentials by setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables or by using the AWS CLI.

4. Write Python code: Use the following Python code to remediate the Route 53 Domain Expiry in 30 days issue:

import boto3
import datetime

# Set the number of days before expiry
expiry_days = 30

# Create a Route 53 client
client = boto3.client('route53domains')

# Get a list of all domains
response = client.list_domains()

# Loop through each domain and check if it will expire in the next 30 days
for domain in response['Domains']:
    domain_name = domain['DomainName']
    expiration_date = domain['Expiry']
    days_left = (expiration_date - datetime.datetime.now()).days
    if days_left <= expiry_days:
        # Renew the domain
        client.renew_domain(
            DomainName=domain_name,
            DurationInYears=1
        )

This code will get a list of all Route 53 domains and check if they will expire in the next 30 days. If a domain is going to expire, it will be renewed for another year. You can schedule this Python script to run periodically to ensure that your domains are always up-to-date.

Using Terraform

provider "aws" {
  region = "us-east-1" # Route 53 Domains API is only in us-east-1
}

resource "aws_route53domains_registered_domain" "DOMAIN_REGISTRATION" {
  domain_name = "YOUR_DOMAIN_NAME" # e.g., "example.com"

  auto_renew = true
}

This Terraform configuration expresses the same preventative fix as aws route53domains enable-domain-auto-renew by setting auto_renew = true on the Route 53 domain registration so AWS will attempt to renew the domain automatically 30–60 days before expiration (and bill the account accordingly).

Terraform cannot perform the one-time, immediate renewal (renew-domain) because that is an on-demand runtime action, not a declarative configuration; use the AWS CLI or Console for that step when the domain is close to expiring.

No replacement of the domain registration is forced by changing auto_renew; it is an in-place update, but enabling it will incur renewal charges when AWS performs the automatic renewal.

For verification, terraform plan should show the aws_route53domains_registered_domain.DOMAIN_REGISTRATION resource with auto_renew changing from false (or unset) to true, or being created with auto_renew = true if it’s new.

Additional Reading:

• https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-restore-expired.html