6.1 Ensure Root Domain Alias Record Points to ELB

Information

Amazon Route 53 translates friendly domains names like www.example.com into IP addresses like 192.0.2.1. Amazon Route 53 responds to DNS queries using a global network of authoritative DNS servers, which reduces latency.

When someone enters your domain name in a browser, a DNS request is forwarded to the nearest Amazon Route 53 DNS server in a global network of authoritative DNS servers. Amazon Route 53 responds with the IP address that you specified.

Each domain has an associated hosted zone which contains the resource records pointing to each layer of the application.

A private hosted zone is a container that holds information about how you want to route traffic for a domain and its subdomains within the Amazon Virtual Private Cloud (Amazon VPC). To begin, you create a private hosted zone and specify the Amazon VPCs that you want to associate with the hosted zone. You then create resource record sets that determine how Amazon Route 53 responds to queries for your domain and subdomains within and among your Amazon VPCs.
Route53 provides special record type called Alias that allow to create an A record for the root domain and point it to the fully qualified domain of the Elastic Load Balancer (ELB) associated with the web-server layer or Amazon CloudFront.

In the same way records for all other layers should be created in order to allow flexibility in the application design and not hard-code the FQDN of a resource.

Solution

Using the Amazon unified command line interface:

* Create a hosted zone for YourDomain.com:

aws route53 create-hosted-zone --name <y_our_domain.com>_ --caller-reference _<any_string>_

See Also

https://workbench.cisecurity.org/files/260

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-20

Plugin: amazon_aws

Control ID: 19c4dd8bf0bd10c1f2c3e3dd79ca4c1db16f04b509c7e59a33a1e638b747dd31