GCP DNS Managed Zones Should Config State Should Be On
More Info:
Ensure that Cloud DNS Managed Zones config state is on.Risk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “GCP DNS Managed Zones Should Config State Should Be On” in GCP using the GCP console, follow these steps:
- Log in to the GCP console and select the project where the DNS Managed Zones configuration needs to be remediated.
- Navigate to the “DNS” page from the left-hand menu.
- Select the “Managed Zones” tab from the top menu.
- Identify the Managed Zones with the “Config State” set to “Off”.
- Click on the name of each Managed Zone with the “Config State” set to “Off”.
- Click on the “Edit” button at the top of the Managed Zone page.
- Scroll down to the “Advanced” section.
- Toggle the “Config State” switch to “On”.
- Click on the “Save” button at the bottom of the page.
- Repeat steps 5-9 for each Managed Zone with the “Config State” set to “Off”.
Using CLI
Using CLI
To remediate the misconfiguration of GCP DNS Managed Zones Config State being off, you can follow the below steps using GCP CLI:
- Open the Cloud Shell in GCP Console.
-
Run the following command to list all the managed zones in your project:
- Identify the managed zone that has “config-state” set to “off”.
-
Run the following command to update the “config-state” of the identified managed zone to “on”:
Replace [MANAGED_ZONE_NAME] with the actual name of the managed zone.
-
Verify that the “config-state” of the managed zone has been updated by running the following command:
This command should return the details of the managed zone, including the updated “config-state” value.
Using Python
Using Python
To remediate the GCP DNS Managed Zones Config State issue using Python, you can use the Google Cloud DNS API client library. Here are the step-by-step instructions:This code will remediate the GCP DNS Managed Zones Config State issue by setting the
- Install the
google-cloud-dnsPython package using pip:
- Authenticate with the Google Cloud Platform by setting the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable to the path of your service account key file:
- Import the necessary modules:
- Create a
dns.Clientobject using the service account credentials:
- Retrieve the list of Managed Zones:
- For each zone, check if the
configproperty is set toon. If it’s not, update the zone’sconfigproperty using theclient.update_zone()method:
- Your code should look like this:
config property to on for all Managed Zones in your project.