Ensure Time To Live (TTL) of the DNS record is not more than 60 minutes for Azure Private DNS Cname Record

MEDIUM

Description

Azure Private DNS Cname Record has time-to-live (TTL) set to more than 1 hour. This may expose the DNS records to vulnerabilities such as cache poisoning.

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Private DNS Zones.
  2. Select the zone you wish to edit.
  3. Under Overview, select the resource record set (CNAME) you wish to edit.
  4. Set TTL to 1 hour (3600 seconds).
  5. Save.

In Terraform -

  1. In the azurerm_private_dns_cname_record resource, set ttl to and hour or less (3600).

References:
https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_dns_cname_record#ttl

Policy Details

Rule Reference ID: AC_AZURE_0112
CSP: Azure
Remediation Available: Yes
Resource Category: Virtual Network
Resource Type: DNS

Frameworks