> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP DNS Managed Zones Should Config State Should Be On

### More Info:

Ensure that Cloud DNS Managed Zones config state is on.

### Risk Level

High

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "GCP DNS Managed Zones Should Config State Should Be On" in GCP using the GCP console, follow these steps:

        1. Log in to the GCP console and select the project where the DNS Managed Zones configuration needs to be remediated.

        2. Navigate to the "DNS" page from the left-hand menu.

        3. Select the "Managed Zones" tab from the top menu.

        4. Identify the Managed Zones with the "Config State" set to "Off".

        5. Click on the name of each Managed Zone with the "Config State" set to "Off".

        6. Click on the "Edit" button at the top of the Managed Zone page.

        7. Scroll down to the "Advanced" section.

        8. Toggle the "Config State" switch to "On".

        9. Click on the "Save" button at the bottom of the page.

        10. Repeat steps 5-9 for each Managed Zone with the "Config State" set to "Off".

        By following these steps, you can remediate the misconfiguration "GCP DNS Managed Zones Should Config State Should Be On" in GCP using the GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of GCP DNS Managed Zones Config State being off, you can follow the below steps using GCP CLI:

        1. Open the Cloud Shell in GCP Console.

        2. Run the following command to list all the managed zones in your project:

           ```
           gcloud dns managed-zones list
           ```

        3. Identify the managed zone that has "config-state" set to "off".

        4. Run the following command to update the "config-state" of the identified managed zone to "on":

           ```
           gcloud dns managed-zones update [MANAGED_ZONE_NAME] --config-state=on
           ```

           Replace \[MANAGED\_ZONE\_NAME] with the actual name of the managed zone.

        5. Verify that the "config-state" of the managed zone has been updated by running the following command:

           ```
           gcloud dns managed-zones describe [MANAGED_ZONE_NAME]
           ```

           This command should return the details of the managed zone, including the updated "config-state" value.

        By following the above steps, you can remediate the misconfiguration of GCP DNS Managed Zones Config State being off.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the GCP DNS Managed Zones Config State issue using Python, you can use the Google Cloud DNS API client library. Here are the step-by-step instructions:

        1. Install the `google-cloud-dns` Python package using pip:

        ```
        pip install google-cloud-dns
        ```

        2. Authenticate with the Google Cloud Platform by setting the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your service account key file:

        ```
        export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service_account_key.json
        ```

        3. Import the necessary modules:

        ```
        from google.cloud import dns
        from google.oauth2 import service_account
        ```

        4. Create a `dns.Client` object using the service account credentials:

        ```
        credentials = service_account.Credentials.from_service_account_file('/path/to/service_account_key.json')
        client = dns.Client(project='your-project-id', credentials=credentials)
        ```

        5. Retrieve the list of Managed Zones:

        ```
        zones = client.list_zones()
        ```

        6. For each zone, check if the `config` property is set to `on`. If it's not, update the zone's `config` property using the `client.update_zone()` method:

        ```
        for zone in zones:
            if zone.config != 'on':
                zone.config = 'on'
                client.update_zone(zone)
        ```

        7. Your code should look like this:

        ```
        from google.cloud import dns
        from google.oauth2 import service_account

        credentials = service_account.Credentials.from_service_account_file('/path/to/service_account_key.json')
        client = dns.Client(project='your-project-id', credentials=credentials)

        zones = client.list_zones()

        for zone in zones:
            if zone.config != 'on':
                zone.config = 'on'
                client.update_zone(zone)
        ```

        This code will remediate the GCP DNS Managed Zones Config State issue by setting the `config` property to `on` for all Managed Zones in your project.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # There is no Terraform argument on a Cloud DNS managed zone that controls a “config state”;
        # the state is managed internally by the Cloud DNS service and is output-only.

        resource "google_dns_managed_zone" "example" {
          name        = "EXAMPLE_ZONE_NAME"        # replace with your zone name
          dns_name    = "EXAMPLE_DNS_NAME."        # replace with your DNS name, must end with a dot
          description = "EXAMPLE_DESCRIPTION"      # optional
          labels = {
            env = "EXAMPLE_ENV_LABEL"              # optional
          }
          visibility = "public"                    # or "private" as needed
        }

        ```

        This finding cannot be remediated via Terraform because Google Cloud DNS does not expose any `config_state` (or similar) field that can be set; the zone’s state is controlled by the service itself and is read-only in the API and provider. To address the alert you must follow your scanner’s guidance, typically by verifying in the Cloud Console that the zone is active and correctly configured, or by consulting the rule’s documentation for how it evaluates “config state.” Since no Terraform-changeable attribute maps to this check, `terraform plan` will not show any change specifically related to “config state.”
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/dns/docs/overview](https://cloud.google.com/dns/docs/overview)