Azure Unrestricted DNS Access - Security Rule

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP and UDP port 53

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
FedRAMP
GDPR
HIPAA
HITRUST CSF
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the unrestricted DNS access issue in Azure, please follow the below steps:

Step 1: Login to the Azure portal (https://portal.azure.com/) using your credentials.

Step 2: In the left-hand side menu, click on the "Networking" option.

Step 3: Under the "Networking" menu, click on the "DNS zones" option.

Step 4: Select the DNS zone that you want to restrict access to.

Step 5: Under the "Settings" menu, click on the "Access control (IAM)" option.

Step 6: Click on the "Add" button to add a new role assignment.

Step 7: In the "Add role assignment" window, select the "Contributor" role from the "Role" dropdown menu.

Step 8: In the "Assign access to" section, select "User, group, or service principal" from the dropdown menu.

Step 9: In the "Select" field, enter the name of the user, group, or service principal that you want to restrict access to.

Step 10: Click on the "Save" button to save the changes.

By following the above steps, you can restrict access to the DNS zone and remediate the unrestricted DNS access issue in Azure.

Using CLI

To remediate Unrestricted DNS Access in AZURE using AZURE CLI, follow these steps:

Open the AZURE CLI and login to your AZURE account.
Run the following command to list all the virtual networks in your subscription:
```
az network vnet list
```
Identify the virtual network that has unrestricted DNS access.
Run the following command to update the virtual network and restrict DNS access:
```
az network vnet update --name <virtual_network_name> --resource-group <resource_group_name> --dns-servers ""
```
Replace <virtual_network_name> with the name of the virtual network that has unrestricted DNS access and <resource_group_name> with the name of the resource group that contains the virtual network.
After running the command, verify that the DNS servers are restricted by running the following command:
```
az network vnet show --name <virtual_network_name> --resource-group <resource_group_name> --query 'dnsServers'
```
This command should return an empty array, which means that DNS access is restricted.

By following these steps, you can remediate Unrestricted DNS Access in AZURE using AZURE CLI.

Using Python

To remediate unrestricted DNS access in Azure using Python, you can use the Azure SDK for Python. Here are the steps:

Install the Azure SDK for Python using pip:

pip install azure-mgmt-dns

Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.dns import DnsManagementClient

Authenticate using Service Principal credentials:

credentials = ServicePrincipalCredentials(
    client_id='<client-id>',
    secret='<client-secret>',
    tenant='<tenant-id>'
)

Replace the <client-id>, <client-secret>, and <tenant-id> with your own values.

Create a DNS management client:

dns_client = DnsManagementClient(credentials, '<subscription-id>')

Replace <subscription-id> with your own subscription ID.

Get the DNS zone that needs to be remediated:

zone_name = '<zone-name>'
resource_group_name = '<resource-group-name>'
zone = dns_client.zones.get(resource_group_name, zone_name)

Replace <zone-name> and <resource-group-name> with your own values.

Remove any records that allow unrestricted access:

for record in zone.records:
    if record.a_records:
        for a_record in record.a_records:
            if a_record.ipv4_address == '0.0.0.0':
                zone.records.remove(record)
    if record.aaaa_records:
        for aaaa_record in record.aaaa_records:
            if aaaa_record.ipv6_address == '::':
                zone.records.remove(record)

This code loops through all the records in the zone and removes any A or AAAA records that allow unrestricted access.

Update the DNS zone:

dns_client.zones.create_or_update(resource_group_name, zone_name, zone)

This code updates the DNS zone with the changes made in step 6.

That's it! This code should remediate unrestricted DNS access in Azure using Python.

Using Terraform

# Existing Network Security Group
resource "azurerm_network_security_group" "dns_nsg" {
  name                = "DNS-NSG"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
}

# Replace any existing "allow DNS from any" rule that has:
#   direction = "Inbound"
#   access    = "Allow"
#   protocol  = "Tcp" or "Udp" or "*"
#   destination_port_range = "53"
#   source_address_prefix = "*"
# with one or more tightly scoped rules like this:

resource "azurerm_network_security_rule" "allow_dns_tcp_restricted" {
  name                        = "allow-dns-tcp-restricted"
  priority                    = 200
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "53"

  # Replace with the specific CIDR(s) that are allowed to query DNS
  source_address_prefixes     = [
    "ALLOWED_DNS_CLIENT_CIDR_1", # e.g. "10.0.0.0/16"
    "ALLOWED_DNS_CLIENT_CIDR_2", # optional additional CIDR
  ]

  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

resource "azurerm_network_security_rule" "allow_dns_udp_restricted" {
  name                        = "allow-dns-udp-restricted"
  priority                    = 210
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Udp"
  source_port_range           = "*"
  destination_port_range      = "53"

  # Replace with the specific CIDR(s) that are allowed to query DNS
  source_address_prefixes     = [
    "ALLOWED_DNS_CLIENT_CIDR_1", # e.g. "10.0.0.0/16"
    "ALLOWED_DNS_CLIENT_CIDR_2",
  ]

  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

# OPTIONAL: If you do not want ANY inbound DNS from the public Internet at all,
# you can add explicit deny rules instead of (or in addition to) the allows above.
# Make sure their priorities are higher (lower numeric value) than any existing allows.

resource "azurerm_network_security_rule" "deny_dns_from_internet_tcp" {
  name                        = "deny-dns-tcp-from-internet"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "53"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

resource "azurerm_network_security_rule" "deny_dns_from_internet_udp" {
  name                        = "deny-dns-udp-from-internet"
  priority                    = 110
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Udp"
  source_port_range           = "*"
  destination_port_range      = "53"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

Changing security rules is in-place and does not replace the azurerm_network_security_group, but it can immediately impact DNS reachability for affected clients once applied.

Verification: terraform plan should show removal or modification of any existing inbound Allow rules on TCP/UDP port 53 that have source_address_prefix = "*" / "0.0.0.0/0" or similar, and the creation of the restricted or deny rules above with the desired CIDR ranges.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​