> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # GCP DNS Key Should Use Secure Algorithm ### More Info: Ensure that Cloud DNS key uses secure algorithm for encryption. ### Risk Level High ### Address Security ### Compliance Standards * Cloudanix Best Practice ### Triage and Remediation ### Remediation To remediate the misconfiguration "GCP DNS Key Should Use Secure Algorithm" in GCP using GCP console, follow the below steps: 1. Login to GCP console and navigate to the Cloud DNS page. 2. Click on the name of the DNS zone for which you want to remediate the misconfiguration. 3. In the left-hand menu, click on the "DNSSEC" tab. 4. Check the "DNSSEC" box to enable DNSSEC for the selected DNS zone. 5. Click on the "Create" button to create a new DNSSEC key. 6. In the "Algorithm" drop-down list, select an algorithm that is considered secure. For example, you can choose "RSASHA256" or "RSASHA512". 7. Click on the "Create" button to create the new key. 8. Once the key is created, click on the "Activate" button to activate DNSSEC for the selected DNS zone. 9. Wait for the DNSSEC activation to complete. This may take a few minutes. 10. Once the activation is complete, verify that the DNSSEC status for the selected DNS zone is "Active". By following these steps, you have successfully remediated the misconfiguration "GCP DNS Key Should Use Secure Algorithm" in GCP using GCP console. # To remediate the GCP DNS Key Should Use Secure Algorithm misconfiguration, you can follow the below steps using GCP CLI: 1. Open the Cloud Shell from the GCP Console. 2. Run the following command to list all the DNS keys in your GCP project: ``` gcloud dns dns-keys list --project [PROJECT_ID] ``` Replace \[PROJECT\_ID] with your GCP project ID. 3. Identify the DNS key that uses an insecure algorithm. The algorithm is listed under the 'algorithm' field in the output of the previous command. 4. Run the following command to delete the insecure DNS key: ``` gcloud dns dns-keys delete [KEY_ID] --project [PROJECT_ID] --zone [ZONE_NAME] ``` Replace \[KEY\_ID] with the ID of the insecure DNS key, \[PROJECT\_ID] with your GCP project ID, and \[ZONE\_NAME] with the name of the DNS zone where the key is used. 5. Run the following command to create a new DNS key using a secure algorithm: ``` gcloud dns dns-keys create [ZONE_NAME] --project [PROJECT_ID] --key-algorithm rsasha256 ``` Replace \[ZONE\_NAME] with the name of the DNS zone where you want to create the new key, and \[PROJECT\_ID] with your GCP project ID. 6. Update the DNS zone to use the new DNS key. This can be done through the GCP Console or using the following command: ``` gcloud dns record-sets import [ZONE_FILE] --project [PROJECT_ID] --zone [ZONE_NAME] ``` Replace \[ZONE\_FILE] with the path to the zone file containing the DNS records, \[PROJECT\_ID] with your GCP project ID, and \[ZONE\_NAME] with the name of the DNS zone. After following these steps, your GCP DNS key should now use a secure algorithm. To remediate the misconfiguration "GCP DNS Key Should Use Secure Algorithm" using Python, you can follow these steps: 1. Connect to your GCP project using the Python client library. You can use the following code to authenticate and connect to your project: ```python theme={null} from google.oauth2 import service_account from google.cloud import dns # Authenticate using a service account key file credentials = service_account.Credentials.from_service_account_file('path/to/keyfile.json') client = dns.Client(project='your-project-id', credentials=credentials) ``` 2. Retrieve the existing DNS key using the `dns.DnsKey` class: ```python theme={null} dns_key = client.fetch_dnskey(zone_name='example.com.') ``` 3. Check the algorithm used by the DNS key. You can do this by checking the `algorithm` property of the `dns_key` object. The algorithm should be one of the following values: RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384. ```python theme={null} if dns_key.algorithm not in ['RSASHA256', 'RSASHA512', 'ECDSAP256SHA256', 'ECDSAP384SHA384']: # Algorithm is not secure ``` 4. If the algorithm is not secure, you can create a new DNS key with a secure algorithm using the `dns.DnsKey` class: ```python theme={null} new_dns_key = dns.DnsKey( zone_name='example.com.', algorithm='RSASHA256', # or any other secure algorithm key_length=2048 # or any other key length ) ``` 5. Delete the existing DNS key and add the new one: ```python theme={null} dns_key.delete() client.add_record_set(new_dns_key) ``` 6. Verify that the new DNS key has been added successfully: ```python theme={null} dns_key = client.fetch_dnskey(zone_name='example.com.') if dns_key.algorithm != 'RSASHA256': # or any other secure algorithm # New DNS key was not added successfully ``` By following these steps, you will be able to remediate the misconfiguration "GCP DNS Key Should Use Secure Algorithm" using Python. ```hcl theme={null} resource "google_dns_managed_zone" "secure_dnssec_zone" { name = "SECURE_ZONE_NAME" # e.g. "prod-example-com" dns_name = "DNS_NAME." # e.g. "example.com." description = "Managed zone with secure DNSSEC key algorithms" dnssec_config { state = "on" # KSK (key-signing key) default_key_specs { key_type = "keySigning" algorithm = "ecdsap256sha256" # secure algorithm key_length = 256 } # ZSK (zone-signing key) default_key_specs { key_type = "zoneSigning" algorithm = "ecdsap256sha256" # secure algorithm key_length = 256 } } } ``` Replace `SECURE_ZONE_NAME` and `DNS_NAME` with your managed zone’s name and DNS name.\ Changing the DNSSEC key algorithms rotates keys and signatures but does not replace the managed zone itself. For verification, `terraform plan` should show your `google_dns_managed_zone` updating the `dnssec_config.default_key_specs[*].algorithm` from the previous (insecure) value(s) to `"ecdsap256sha256"` (or another approved secure algorithm such as `"rsasha256"` or `"rsasha512"`). ### Additional Reading: * [https://cloud.google.com/dns/docs/dnssec-advanced](https://cloud.google.com/dns/docs/dnssec-advanced)