6.2 Ensure a DNS alias record for the root domain

Information

While ordinary Amazon Route 53 resource record sets are standard DNS resource record sets, _alias resource record sets_ provide an Amazon Route 53-specific extension to DNS functionality. Instead of an IP address or a domain name, an alias resource record set contains a pointer to a CloudFront distribution or an ELB load balancer.

Alias resource record sets can save you time because Amazon Route 53 automatically recognizes changes in the resource record sets that the alias resource record set refers to.
In order to point the root domain to a CloudFront distribution or an Elastic Load Balancer (ELB), an alias resource record set should be created.

Solution

First create a json file that represents the alias record that you want to add, and save it locally as "alias.json". Below you can find a simple alias record representation:

{
"Changes": [
{
"Action": "CREATE",
"ResourceRecordSet": {
"Name": "_<your_root_domain>_",
"Type": "A",
"AliasTarget": {
"HostedZoneId": "hosted zone ID for your CloudFront distribution, Amazon S3 bucket, Elastic Load Balancing load balancer, or Amazon Route 53 hosted zone",
"DNSName": "DNS domain name for your CloudFront distribution, Amazon S3 bucket, Elastic Load Balancing load balancer, or another resource record set in this hosted zone",
"EvaluateTargetHealth": false
}
}
}
]
}

Using the Amazon unified command line interface:

* Create an Alias records in your hosted zone:

aws route53 change-resource-record-sets --hosted-zone-id <_your_hosted_zone_id>_ --change-batch file:///PathTo/alias.json

See Also

https://workbench.cisecurity.org/files/260

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-20

Plugin: amazon_aws

Control ID: bdde447e5fd2c13e92f1086929bb7739df67da2accf74cf47b68072c0d81fac7