Route 53 Should Be In Use

More Info:

AWS Route 53 Domain Name System (DNS) service should be used within your AWS account to manage DNS zones for your domains.

Risk Level

Medium

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration “Route 53 should be in use” for AWS using the AWS console, follow these steps:

1. Open the AWS Management Console and navigate to Route 53.
2. Create a new hosted zone for your domain name if you haven’t already done so.
3. Click on the “Create Record Set” button to create a new record set.
4. In the “Name” field, enter the domain name that you want to associate with the record set.
5. In the “Type” field, select the type of record that you want to create (e.g. A, CNAME, MX, etc.).
6. In the “Value” field, enter the IP address or domain name that you want to associate with the record set.
7. Click on the “Create” button to create the record set.
8. Repeat steps 3-7 for any additional record sets that you want to create.

Once you have created the necessary record sets in Route 53, you can update your DNS settings to point to your Route 53 hosted zone. This will ensure that your domain name is properly configured and that Route 53 is in use.

Using CLI

To remediate the misconfiguration “Route 53 should be in use” for AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine.

2. Check if the Route 53 service is enabled for your AWS account using the following command:

aws route53 list-hosted-zones

If the command returns a list of hosted zones, that means Route 53 is already enabled for your account. If it returns an error, Route 53 is not enabled.

3. If Route 53 is not enabled, enable it using the following command:

aws route53 create-hosted-zone --name example.com --caller-reference 1

Replace “example.com” with your domain name and “1” with a unique reference number.

4. Once Route 53 is enabled, you can start using it to manage your DNS records.

5. Update your DNS records to point to the appropriate resources using the Route 53 console or CLI.

6. Verify that your DNS records have been updated correctly using the following command:

nslookup example.com

Replace “example.com” with your domain name.

7. If the command returns the expected IP address, your DNS records have been updated successfully.

By following these steps, you can remediate the misconfiguration “Route 53 should be in use” for AWS using AWS CLI.

Using Python

To remediate the misconfiguration “Route 53 Should Be In Use” for AWS using Python, follow these steps:

1. Import the necessary libraries:

import boto3

2. Create a Route 53 hosted zone:

client = boto3.client('route53')
response = client.create_hosted_zone(
    Name='example.com',
    CallerReference=str(time.time())
)

Note: Replace “example.com” with your own domain name.

3. Update the NS records for the domain with the Route 53 name servers:

response = client.get_hosted_zone(Id=response['HostedZone']['Id'])
for ns in response['DelegationSet']['NameServers']:
    print(ns)

4. Update the domain registrar with the new NS records.

Note: This step will vary depending on your domain registrar.

5. Verify that the domain is now using Route 53 by checking the DNS records:

response = client.list_resource_record_sets(
    HostedZoneId=response['HostedZone']['Id'],
    MaxItems='1'
)
print(response['ResourceRecordSets'][0])

6. Delete any existing DNS records that conflict with the new Route 53 hosted zone:

response = client.list_resource_record_sets(
    HostedZoneId=response['HostedZone']['Id']
)
for record in response['ResourceRecordSets']:
    if record['Type'] == 'A' and record['Name'] == 'example.com.':
        client.change_resource_record_sets(
            HostedZoneId=response['HostedZone']['Id'],
            ChangeBatch={
                'Changes': [
                    {
                        'Action': 'DELETE',
                        'ResourceRecordSet': record
                    }
                ]
            }
        )

7. Wait for the DNS changes to propagate, which can take up to 48 hours.

Note: It is recommended to test the DNS changes using a DNS propagation checker tool before assuming that the changes have propagated.

By following these steps, you can remediate the misconfiguration “Route 53 Should Be In Use” for AWS using Python.

Using Terraform

Terraform cannot express “delete this hosted zone” as a positive resource block; the remediation is to stop managing the unused zone and destroy it.

To remediate with Terraform:

1. Identify the unused hosted zone resource, e.g.:
   resource "aws_route53_zone" "UNUSED_ZONE_NAME" {
     name = "EXAMPLE.COM." # replace with your zone
   }
   
2. Remove this aws_route53_zone block (or set count = 0 / remove it from any for_each).
3. Run:
   • terraform plan – it should show the hosted zone as -/destroy.
   • terraform apply – this will issue the equivalent of aws route53 delete-hosted-zone --id HOSTED_ZONE_ID.

This forces permanent deletion of the hosted zone and all non-default records; verify it is unused and not delegated at your registrar before applying. After editing, terraform plan should show only that the aws_route53_zone resource will be destroyed.

Additional Reading:

• https://aws.amazon.com/route53/