Ensure that a DNS Alias record is created for the root domain name within your Amazon Route 53 hosted zone. An Alias record is a special DNS record type that allows you to create an A record for the root domain and point it to the fully qualified domain name (FQDN) of an AWS resource such as a Network Load Balancer (NLB), an S3 website endpoint, or a CloudFront web distribution. Before running this rule by the Trend Cloud One™ – Conformity engine, your root domain name must be configured in the rule settings, on your Conformity account console.
Alias records provide a Route 53–specific extension to DNS functionality and can save you time as the Route 53 service automatically recognizes changes in the DNS records that the Alias record refers to. For example, suppose an Alias record for domain.com points to a load balancer at aws-prod-elb.us-east-1.elb.amazonaws.com. If the IP address of the load balancer changes, Amazon Route 53 will automatically reflect those changes in DNS responses for domain.com without any changes to the hosted zone that contains the DNS records for the root domain. Therefore, to point the root domain name to a supported AWS cloud resource such as an S3 endpoint or a CloudFront web distribution, an Alias DNS record set should be created.
Note: Make sure that you replace all <root_domain_name>
placeholders outlined in the conformity rule content with your own root domain name.
Audit
To determine if there is an Alias record set created for the root domain within your Amazon Route 53 hosted zones, perform the following operations:
Remediation / Resolution
To create and configure a DNS Alias record for your root domain name, perform the following operations:
References
- AWS Documentation
- Working with Public Hosted Zones
- Creating Records by Using the Amazon Route 53 Console
- Configuring Amazon Route 53 as Your DNS Service
- Values for Alias Records
- CIS Amazon Web Services Foundations
- AWS Command Line Interface (CLI) Documentation
- route53
- list-hosted-zones
- list-resource-record-sets
- change-resource-record-sets
- get-change