AWS Route53 medium security documentation change
Summary
Updated migration steps to include DNSSEC handling, TTL management, and health check migration. Added detailed preparation steps including DNSSEC chain of trust removal/re-establishment and operational safeguards.
Security assessment
The changes explicitly address DNSSEC handling (removing DS records pre-migration and re-enabling post-migration), which is a security feature. The documentation now includes security-critical steps for maintaining DNSSEC validation during migration.
Diff
diff --git a/Route53/latest/DeveloperGuide/hosted-zones-migrating.md b/Route53/latest/DeveloperGuide/hosted-zones-migrating.md index 42ff18899..524fc9990 100644 --- a//Route53/latest/DeveloperGuide/hosted-zones-migrating.md +++ b//Route53/latest/DeveloperGuide/hosted-zones-migrating.md @@ -5 +5 @@ -Step 1: Install or upgrade the AWS CLIStep 2: Create the new hosted zoneStep 3: Create a file that contains the records that you want to migrateStep 4: Edit the records that you want to migrateStep 5: Split large files into smaller filesStep 6: Create records in the new hosted zoneStep 7: Compare records in the old and new hosted zonesStep 8: Update the domain registration to use name servers for the new hosted zoneStep 9: Wait for DNS resolvers to start using the new hosted zoneStep 10: (Optional) delete the old hosted zone +Step 1: Prepare for migrationStep 2: Create the new hosted zoneStep 3: (Optional) Migrate health checksStep 4: Migrate records from the old hosted zone to the new hosted zoneStep 5: Compare records in the old and new hosted zonesStep 6: Update the domain registration to use name servers for the new hosted zoneStep 7: Change the TTL for the NS record back to a higher valueStep 8: Re-enable DNSSEC signing and establish the chain of trust (if required)Step 9: (Optional) delete the old hosted zone @@ -9 +9 @@ Step 1: Install or upgrade the AWS CLIStep 2: Create the new hosted zoneStep 3: -If you want to migrate a hosted zone from one AWS account to a different account, you can programmatically list the records in the old hosted zone, edit the output, and then programmatically create records in a new hosted zone using the edited output. Note the following: +When migrating a hosted zone to a different AWS account, follow these recommended steps. @@ -11 +11 @@ If you want to migrate a hosted zone from one AWS account to a different account - * If you have only a few records, you can also use the Route 53 console to create records in the new hosted zone. For more information, see [Creating records by using the Amazon Route 53 console](./resource-record-sets-creating.html). +These steps are most suitable for hosted zones with infrequent record changes. For hosted zones with frequent record updates, consider the following: @@ -13 +13 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Some procedures use the AWS Command Line Interface (AWS CLI). You can also perform those procedures by using one of the AWS SDKs, the Amazon Route 53 API, or AWS Tools for Windows PowerShell. For this topic, we use the AWS CLI because it's easier for small numbers of hosted zones. + * Don't update any resource records during migration. @@ -15 +15 @@ If you want to migrate a hosted zone from one AWS account to a different account - * You can also use this process to create records in a new hosted zone that has a different name than an existing hosted zone but that has the same records. + * Publish resource record changes in both old and new hosted zones after the delegation has been transferred. @@ -17 +16,0 @@ If you want to migrate a hosted zone from one AWS account to a different account - * You can't migrate alias records that route traffic to traffic policy instances. @@ -20,0 +20,11 @@ If you want to migrate a hosted zone from one AWS account to a different account +###### Prerequisites + +Install or upgrade the AWS CLI: + +For information about downloading, installing, and configuring the AWS CLI, see the [AWS Command Line Interface User Guide](https://docs.aws.amazon.com/cli/latest/userguide/). + +###### Note + +Configure the CLI so that you can use it when you're using both the account that created the hosted zone and the account that you're migrating the hosted zone to. For more information, see [Configure](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) in the _AWS Command Line Interface User Guide_ + +If you're already using the AWS CLI, we recommend that you upgrade to the latest version of the CLI so that the CLI commands support the latest Route 53 features. @@ -24 +34 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 1: Install or upgrade the AWS CLI + * Step 1: Prepare for migration @@ -28 +38 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 3: Create a file that contains the records that you want to migrate + * Step 3: (Optional) Migrate health checks @@ -30 +40 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 4: Edit the records that you want to migrate + * Step 4: Migrate records from the old hosted zone to the new hosted zone @@ -32 +42 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 5: Split large files into smaller files + * Step 5: Compare records in the old and new hosted zones @@ -34 +44 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 6: Create records in the new hosted zone + * Step 6: Update the domain registration to use name servers for the new hosted zone @@ -36 +46 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 7: Compare records in the old and new hosted zones + * Step 7: Change the TTL for the NS record back to a higher value @@ -38 +48 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 8: Update the domain registration to use name servers for the new hosted zone + * Step 8: Re-enable DNSSEC signing and establish the chain of trust (if required) @@ -40 +50 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 9: Wait for DNS resolvers to start using the new hosted zone + * Step 9: (Optional) delete the old hosted zone @@ -42 +51,0 @@ If you want to migrate a hosted zone from one AWS account to a different account - * Step 10: (Optional) delete the old hosted zone @@ -45,0 +55 @@ If you want to migrate a hosted zone from one AWS account to a different account +## Step 1: Prepare for migration @@ -47 +57 @@ If you want to migrate a hosted zone from one AWS account to a different account -## Step 1: Install or upgrade the AWS CLI +The preparation steps help you minimize the risks associated with migrating a hosted zone. @@ -49 +59 @@ If you want to migrate a hosted zone from one AWS account to a different account -For information about downloading, installing, and configuring the AWS CLI, see the [AWS Command Line Interface User Guide](https://docs.aws.amazon.com/cli/latest/userguide/). +###### 1\. Monitor zone availability @@ -51 +61 @@ For information about downloading, installing, and configuring the AWS CLI, see -###### Note +You can monitor the zone for the availability of your domain names. This can help you address any issues that might lead to rolling back the migration. You can monitor for your domain names with most traffic by using CloudWatch or query logging. For more information about setting up query logging, see [Monitoring Amazon Route 53](./monitoring-overview.html). @@ -53 +63 @@ For information about downloading, installing, and configuring the AWS CLI, see -Configure the CLI so that you can use it when you're using both the account that created the hosted zone and the account that you're migrating the hosted zone to. For more information, see [Configure](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) in the _AWS Command Line Interface User Guide_ +The monitoring can be done through a shell script, or through a third party service. It shouldn't, however, be the only signal to determine if a rollback is required as you might also get feedback from your customers due to a domain not being available. @@ -55 +65,34 @@ Configure the CLI so that you can use it when you're using both the account that -If you're already using the AWS CLI, we recommend that you upgrade to the latest version of the CLI so that the CLI commands support the latest Route 53 features. +###### 2\. Lower the TTL setting + +The TTL (time to live) setting for a record specifies how long you want DNS resolvers to cache the record and use the cached information. When the TTL expires, a resolver sends another query to the DNS service provider for a domain to get the latest information. + +The typical TTL setting for the NS record is 172800 seconds, or two days. The NS record lists the name servers that the Domain Name System (DNS) can use to get information about how to route traffic for your domain. Lowering the TTL for the NS record, both with your current DNS service provider and with Route 53, reduces downtime for your domain if you discover a problem while you're migrating DNS to Route 53. If you don't lower the TTL, your domain could be unavailable on the internet for up to two days if something goes wrong. + +###### To lower the TTL + + 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). + + 2. Choose **Hosted zones** in the navigation pane. + + 3. Choose the name of the hosted zone. + + 4. Choose the NS record, and and in the **Record details** pane, choose **Edit record**. + + 5. Change the value of **TTL (Seconds)**. We recommend that you specify a value between 60 seconds and 900 seconds (15 minutes). + + 6. Choose **Save**. + + + + +###### 3\. Remove the DS record from the parent zone (If you have DNSSEC configured) + +If you've configured DNSSEC for your domain, remove the Delegation Signer (DS) record from the parent zone before you migrate your domain to Route 53. + +If the parent zone is hosted through Route 53, see [Deleting public keys for a domain](./domain-configure-dnssec.html#domain-configure-dnssec-deleting-keys) for more information. If the parent zone is hosted on another registrar, contact them to remove the DS record. + +Route 53 does not currently support migrating the DNSSEC setting. As such, you will need to disable DNSSEC validation performed against your domain prior to the migration by removing the DS record from the parent zone. After the migration, you can re-enable DNSSEC validation by configuring DNSSEC on the new hosted zone and adding the respective DS record to the parent zone. + +###### 4\. Make sure there are no other ongoing operations relying on the migrating hosted zone + +Some operations will rely on DNS resolution in the migrating hosted zone, for example, the TLS/SSL certificate renewal process may require making DNS record changes and the provider will try to resolve the DNS record as the validation method. Before the migration, you should make sure there is no other operation happening, in order to avoid unexpected impact from the hosted zone migration. @@ -59 +102,15 @@ If you're already using the AWS CLI, we recommend that you upgrade to the latest -The following procedure explains how to use the Route 53 console to create the hosted zone that you want to migrate to. +Create the new hosted zone in the account you want to migrate the hosted zone to. + +Choose the tab for the instructions for either the AWS CLI or console. + + * CLI + + * Console + + + + +CLI + + +Enter the following command: @@ -61 +117,0 @@ The following procedure explains how to use the Route 53 console to create the h -###### Note @@ -63 +119,9 @@ The following procedure explains how to use the Route 53 console to create the h -Route 53 assigns a new set of four name servers to the new hosted zone. After you migrate a hosted zone to another AWS account, you need to update the domain registration to use the name servers for the new hosted zone. We remind you about this step later in the process. + aws route53 create-hosted-zone \ + --name $hosted_zone_name \ + --caller-reference $unique_string + + +For more information, see [create-hosted-zone](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/route53/create-hosted-zone.html). + +Console + @@ -80 +144 @@ Sign in with the account credentials for the account that you want to migrate th -## Step 3: Create a file that contains the records that you want to migrate +Lower the NS TTL in the new zone as well, similar to Lower TTL setting in preparation Step 1, Lower the TTL setting. @@ -82 +146 @@ Sign in with the account credentials for the account that you want to migrate th -To migrate records from one hosted zone to another, you create a file that contains the records that you want to migrate, edit the file, and then use the edited file to create records in the new hosted zone. Perform the following procedure to create the file. +## Step 3: (Optional) Migrate health checks @@ -84 +148 @@ To migrate records from one hosted zone to another, you create a file that conta -###### To create a file that contains records that you want to migrate +You can associate DNS records in the new account with Route 53 health checks from the account you're migrating from. To migrate a Route 53 health check, you need to create new health checks in your new account with the same configuration as your existing ones. For more information, see [Creating Amazon Route 53 health checks ](./dns-failover.html). @@ -86 +150 @@ To migrate records from one hosted zone to another, you create a file that conta - 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). +## Step 4: Migrate records from the old hosted zone to the new hosted zone @@ -88 +152 @@ To migrate records from one hosted zone to another, you create a file that conta -Sign in with the account credentials for the account that created the hosted zone that you want to migrate. +You can migrate records from an AWS account to another by using the console or the AWS CLI @@ -90 +154 @@ Sign in with the account credentials for the account that created the hosted zon - 2. Get the hosted zone ID for the hosted zone that you want to migrate: +**Console** @@ -92 +156 @@ Sign in with the account credentials for the account that created the hosted zon - 1. In the navigation pane, choose **Hosted zones**. +If your zone contains just a few records, you can consider to use Route 53 console to list the records in your old zone, note them down, and create them in the new zone. If you have migrated the health check in Step 3: (Optional) Migrate health checks, when you create the records in the new hosted zone, you should specify the new health check ID. For more information, see the following topics: @@ -94 +158 @@ Sign in with the account credentials for the account that created the hosted zon - 2. Find the hosted zone that you want to migrate. If you have a lot of hosted zones, you can choose **Exact domain name** and enter the name of the hosted zone, and press **Enter** to filter the list. + * [Listing records](./resource-record-sets-listing.html) @@ -96 +160 @@ Sign in with the account credentials for the account that created the hosted zon - 3. Get the value of the **Hosted zone ID** column. + * [Creating records by using the Amazon Route 53 console](./resource-record-sets-creating.html) @@ -98 +162 @@ Sign in with the account credentials for the account that created the hosted zon - 3. Run the following command: + * [Configuring DNS failover](./dns-failover-configuring.html) @@ -100 +163,0 @@ Sign in with the account credentials for the account that created the hosted zon - aws route53 list-resource-record-sets --hosted-zone-id hosted-zone-id > path-to-output-file @@ -102 +164,0 @@ Sign in with the account credentials for the account that created the hosted zon -Note the following: @@ -104,3 +165,0 @@ Note the following: - * For `hosted-zone-id`, specify the ID of the hosted zone that you got in step 2 of this procedure. - - * For `path-to-output-file`, specify the directory path and file name that you want to save the output in. @@ -108 +167 @@ Note the following: - * The `>` character sends the output to the specified file. +You should lower the NS TTL in the new zone as well, similar to Lower TTL setting in Step 1. @@ -110 +169 @@ Note the following: - * The AWS CLI automatically handles pagination for hosted zones that contain more than 100 records. For more information, see [Using the AWS Command Line Interface's pagination options](https://docs.aws.amazon.com/cli/latest/userguide/pagination.html) in the _AWS Command Line Interface User Guide_. +**Migrate records programmatically** @@ -112 +171 @@ Note the following: -If you use another programmatic method to list records, such as one of the AWS SDKs, you can get a maximum of 100 records per page of results. If the hosted zone contains more than 100 records, you must submit multiple requests to list all records. +If your zone contains a large number of records, you would consider to export the records you want to migrate to a file, edit the file, and then use the edited file to create records in the new hosted zone. The following procedure will use AWS CLI commands as the reference, there are also third part tools for this purpose. @@ -114 +173 @@ If you use another programmatic method to list records, such as one of the AWS S - * To run the command in versions of Windows PowerShell earlier than 6.0, use the following syntax: +###### @@ -116 +175 @@ If you use another programmatic method to list records, such as one of the AWS S - aws route53 list-resource-record-sets --hosted-zone-id hosted-zone-id | Out-File path-to-output-file -Encoding utf8 + 1. Run the following command: @@ -118 +177 @@ If you use another programmatic method to list records, such as one of the AWS S -For example, if you're running the AWS CLI on a Windows computer, you might run the following command: + aws route53 list-resource-record-sets --hosted-zone-id hosted-zone-id > path-to-output-file @@ -120 +179 @@ For example, if you're running the AWS CLI on a Windows computer, you might run - aws route53 list-resource-record-sets --hosted-zone-id ZOLDZONE12345 > c:\temp\list-records-ZOLDZONE12345.txt +Note the following: @@ -122 +181 @@ For example, if you're running the AWS CLI on a Windows computer, you might run -If you're running the AWS CLI on a Windows computer in a version of Windows PowerShell earlier than 6.0, you might run the following command: