Domain transfer lock remediation

Using Console

Sure, here are the steps to remediate the misconfiguration of unlocked Route 53 domains in AWS:

Open the AWS Management Console and go to the Route 53 service.
In the left navigation pane, click on the Registered domains option.
Select the domain that you want to lock.
In the domain details page, click on the “Add/Edit Tags” button.
In the “Add/Edit Tags” dialog box, click on the “Add tag” button.
In the “Key” field, enter “LockDomain” and in the “Value” field, enter “True”.
Click on the “Save changes” button to save the tag.
After adding the tag, click on the “Lock domain” button to lock the domain.
In the “Lock domain” dialog box, review the information and click on the “Lock domain” button to confirm.
Once the domain is locked, you will see the “Domain lock enabled” message on the domain details page.

Congratulations! You have successfully remediated the misconfiguration of unlocked Route 53 domains in AWS.

Using CLI

To remediate the misconfiguration of unlocked Route 53 domains in AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to get a list of your Route 53 domains:

aws route53domains list-domains

For each domain in the list, run the following command to check if it is locked:

aws route53domains get-domain-detail --domain-name <domain-name> | grep "Status: LOCKED"

If the output of this command shows that the domain is already locked, then no further action is needed for that domain.

If the domain is not locked, run the following command to lock it:

aws route53domains update-domain-nameservers --domain-name <domain-name> --nameservers LOCKED

This command will update the nameservers for the domain to be locked.

Finally, run the following command to verify that the domain is now locked:

aws route53domains get-domain-detail --domain-name <domain-name> | grep "Status: LOCKED"

If the output of this command shows that the domain is now locked, then the remediation is complete.

Using Python

To remediate the Route 53 Domains Should Be Locked misconfiguration in AWS using Python, follow these steps:

Install the AWS SDK for Python (Boto3) using the following command:

pip install boto3

Create an AWS IAM user with the necessary permissions to manage Route 53 domains.
Configure the AWS CLI with the IAM user credentials using the following command:

aws configure

Write a Python script to enable domain locking for all Route 53 domains using the following code:

import boto3

# Create a Route 53 client
client = boto3.client('route53domains')

# Get a list of all domains
response = client.list_domains()

# Loop through each domain and enable domain locking
for domain in response['Domains']:
    client.update_domain_dnssec(
        DomainName=domain['DomainName'],
        EnableSuggestion=False,
        KeyTag='12345',
        KmsArn='arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab',
        SecretKey='1234567890123456789012345678901234567890123456789012345678901234',
        Validation='EMAIL'
    )

Save the script and run it using the following command:

python script.py

This will enable domain locking for all Route 53 domains in your AWS account.

Using Terraform

# Route 53 Domains API is only available in us-east-1; set this on the provider,
# not on the resource.
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53domains_registered_domain" "this" {
  domain_name   = "EXAMPLE_DOMAIN_NAME" # replace with your registered domain, e.g. "example.com"
  transfer_lock = true                  # enables the transfer lock (equivalent to enable-domain-transfer-lock)
}

Changing transfer_lock from false to true does not force replacement of the domain; it is an in-place update.To verify, terraform plan should show the aws_route53domains_registered_domain resource with transfer_lock changing from false (or null) to true.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Domain transfer lock remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation