> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain expired remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Route 53 not identifying any expired domains in AWS, you can follow the below steps:

        1. Log in to the AWS Management Console and navigate to the Route 53 service.
        2. Click on the "Registered domains" option in the left-hand menu.
        3. In the list of registered domains, identify the domain that is expired and select it.
        4. Click on the "Renew domain registration" button in the top-right corner of the page.
        5. Follow the on-screen instructions to complete the domain renewal process.
        6. Once the domain is renewed, Route 53 will automatically start identifying it again.

        It is important to note that if the domain is not renewed within a certain period of time, it may become permanently unavailable and cannot be renewed. Therefore, it is recommended to set up auto-renewal for domains in Route 53 to avoid such misconfigurations in the future.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration in AWS Route 53 using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local system or EC2 instance.

        2. Run the following command to list all the hosted zones in your AWS account:

        ```
        aws route53 list-hosted-zones
        ```

        3. Identify the hosted zone that contains the expired domain.

        4. Run the following command to get the details of the expired domain:

        ```
        aws route53 list-resource-record-sets --hosted-zone-id <hosted-zone-id> --query "ResourceRecordSets[?Name == '<expired-domain-name>']"
        ```

        Replace `<hosted-zone-id>` with the ID of the hosted zone that contains the expired domain and `<expired-domain-name>` with the name of the expired domain.

        5. If the output of the above command returns any records for the expired domain, run the following command to delete those records:

        ```
        aws route53 change-resource-record-sets --hosted-zone-id <hosted-zone-id> --change-batch '{"Changes":[{"Action":"DELETE","ResourceRecordSet":{"Name":"<expired-domain-name>","Type":"<record-type>","TTL":<ttl>,"ResourceRecords":[{"Value":"<record-value>"}]}}]}'
        ```

        Replace `<hosted-zone-id>` with the ID of the hosted zone that contains the expired domain, `<expired-domain-name>` with the name of the expired domain, `<record-type>` with the type of record that needs to be deleted (e.g. A, CNAME, MX, etc.), `<ttl>` with the TTL value of the record, and `<record-value>` with the value of the record.

        6. Verify that the expired domain records have been deleted by running the following command:

        ```
        aws route53 list-resource-record-sets --hosted-zone-id <hosted-zone-id> --query "ResourceRecordSets[?Name == '<expired-domain-name>']"
        ```

        This command should not return any records for the expired domain.

        By following these steps, you can remediate the misconfiguration in AWS Route 53 and ensure that any expired domains are identified and deleted.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration in AWS Route 53 using Python, follow the below steps:

        Step 1: Install and configure the AWS CLI on your local machine.

        Step 2: Create a Python script that uses the boto3 library to interact with AWS Route 53.

        Step 3: Use the `list_hosted_zones()` method to get a list of all the hosted zones in your AWS account.

        Step 4: Loop through the hosted zones and use the `list_resource_record_sets()` method to get a list of all the resource record sets in each hosted zone.

        Step 5: Check the `Expiration` field of each resource record set to see if it is expired.

        Step 6: If a resource record set is expired, use the `change_resource_record_sets()` method to delete the record set.

        Step 7: Save and run the Python script.

        Here is a sample Python script that you can use as a starting point:

        ```
        import boto3
        import datetime

        # Create a Route 53 client
        client = boto3.client('route53')

        # Get a list of all the hosted zones
        response = client.list_hosted_zones()
        hosted_zones = response['HostedZones']

        # Loop through the hosted zones
        for zone in hosted_zones:
            zone_id = zone['Id']
            zone_name = zone['Name']

            # Get a list of all the resource record sets in the zone
            response = client.list_resource_record_sets(HostedZoneId=zone_id)
            record_sets = response['ResourceRecordSets']

            # Loop through the resource record sets
            for record_set in record_sets:
                # Check if the record set is expired
                if 'Expiration' in record_set and record_set['Expiration'] < datetime.datetime.now():
                    # Delete the record set
                    response = client.change_resource_record_sets(
                        HostedZoneId=zone_id,
                        ChangeBatch={
                            'Changes': [
                                {
                                    'Action': 'DELETE',
                                    'ResourceRecordSet': record_set
                                }
                            ]
                        }
                    )
                    print(f"Deleted expired record set {record_set['Name']} in zone {zone_name}")
        ```

        Note: This script assumes that the `Expiration` field is already set in the resource record sets. If it is not set, you may need to modify the script to check for other indicators of expiration.
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot renew or restore Route 53 registered domains; the AWS provider does not expose a `renew-domain` or equivalent operation, so this remediation must be done via CLI or console.

        To match the verified CLI fix, use the AWS CLI:

        ```bash theme={null}
        # 1. Get current expiration year
        aws route53domains get-domain-detail \
          --domain-name YOUR_DOMAIN_NAME

        # Note the 4‑digit year in the "ExpirationDate" field, e.g. 2026

        # 2. Renew for 1 year (auto‑renewal grace period only)
        aws route53domains renew-domain \
          --domain-name YOUR_DOMAIN_NAME \
          --duration-in-years 1 \
          --current-expiry-year 2026
        ```

        If the status in `StatusList` is `redemptionPeriod`, follow the AWS console/docs to restore via the more complex `update-domain-contact` flow. Renewing or restoring will incur costs billed to your AWS account.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>