AWS Route 53 public hosted zones without DNSSEC enabled are vulnerable to DNS spoofing, cache poisoning, and man-in-the-middle attacks. Without cryptographic signatures on DNS responses, attackers can forge DNS records to redirect traffic to malicious servers, enabling credential theft, data interception, and service impersonation attacks.
# VULNERABLE: Route 53 without DNSSEC
resource "aws_route53_zone" "company" {
name = "company.com"
# VULNERABLE: No DNSSEC configuration
# No key-signing key
# DNS responses are unsigned
tags = {
Environment = "production"
}
}
resource "aws_route53_record" "www" {
zone_id = aws_route53_zone.company.zone_id
name = "www.company.com"
type = "A"
ttl = 300
records = ["203.0.113.1"]
# VULNERABLE: Can be spoofed via DNS cache poisoning
}
resource "aws_route53_record" "api" {
zone_id = aws_route53_zone.company.zone_id
name = "api.company.com"
type = "A"
ttl = 300
records = ["203.0.113.2"]
# VULNERABLE: API endpoint can be hijacked
}# SECURE: Route 53 with DNSSEC enabled
# SECURE: KMS key for DNSSEC signing
resource "aws_kms_key" "dnssec" {
customer_master_key_spec = "ECC_NIST_P256"
key_usage = "SIGN_VERIFY"
policy = jsonencode({
Statement = [{
Effect = "Allow"
Principal = { Service = "dnssec-route53.amazonaws.com" }
Action = ["kms:Sign", "kms:GetPublicKey"]
Resource = "*"
}]
})
}
resource "aws_route53_zone" "company" {
name = "company.com"
}
# SECURE: Key-signing key for DNSSEC
resource "aws_route53_key_signing_key" "ksk" {
hosted_zone_id = aws_route53_zone.company.id
key_management_service_arn = aws_kms_key.dnssec.arn
name = "company-ksk"
}
# SECURE: Enable DNSSEC signing
resource "aws_route53_hosted_zone_dnssec" "company" {
depends_on = [aws_route53_key_signing_key.ksk]
hosted_zone_id = aws_route53_zone.company.id
signing_status = "SIGNING"
}The vulnerable configuration creates a Route 53 hosted zone without DNSSEC protection, leaving DNS responses unsigned and vulnerable to spoofing and cache poisoning attacks. The secure version creates a customer-managed KMS key with ECC_NIST_P256 specification for cryptographic signing, creates a key-signing key (KSK) linked to the KMS key, and enables DNSSEC signing on the hosted zone. This ensures all DNS responses are cryptographically signed and can be validated by resolvers, preventing attackers from injecting false DNS records or redirecting traffic to malicious servers.
Route 53 public hosted zones created without DNSSEC signing enabled. DNS responses from unsigned zones lack cryptographic signatures, allowing attackers to forge responses and redirect traffic to malicious servers without detection.
Sourcery automatically identifies information disclosure due to unsigned dns responses in route 53 public hosted zones and many other security issues in your codebase.