FIREBREAK: 🔥 Gather Metrics About Cloud Platform Domain Name Delegations

[connormaglynn]

👀 Purpose

• Following on from https://github.com/ministryofjustice/operations-engineering/issues/4523 and https://github.com/ministryofjustice/cloud-platform/issues/5727#issuecomment-2174133535
• To gather insights about Cloud Platform Delegations so that we can better understand whether there is value in maintaining a system for transparent DNS delegations

✅ Tasks

• [x] 💿 Gather Percentage of dsd.io Subdomains That Are Delegated to Cloud Platform
• [x] 💿 Gather Percentage of justice.gov.uk Subdomains That Are Delegated to Cloud Platform
• [x] 💿 Gather Percentage of service.justice.gov.uk Subdomains That Are Delegated to Cloud Platform
• [x] 💿 Gather Percentage of gov.uk Subdomains That Are Delegated to Cloud Platform
• [x] 💿 Gather Percentage of service.gov.uk Subdomains That Are Delegated to Cloud Platform
• [x] 💿 Gather Percentage of non-gov.uk Subdomains That Are Delegated to Cloud Platform

📓 Notes

• 🐳 We have a basic workflow that connects to the CP AWS Account with Read Access
• All of our DNS records are public at https://github.com/ministryofjustice/dns/blob/main which can be used to gather the initial list of delegated subdomains without worrying about authentication
• A delegated subdomain is every NS record in a HostedZone where the record name is not the name of the HostedZone i.e. running the following command in the DSD account for the service.justice.gov.uk HostedZone

  aws route53 list-resource-record-sets --hosted-zone-id="${HOSTED_ZONE_ID}" | jq -r '.ResourceRecordSets[] | select(.Type == "NS") | .Name'

  returns something along the lines of

  service.justice.gov.uk # 👈 Not a delegation since it's the name of the HostedZone
  # 👇 all these are delegations to other HostedZones (maybe in CP, maybe in DSD, maybe somewhere else 👀 )
  test.service.justice.gov.uk
  test2.service.justice.gov.uk

[AntonyBishop]

Have added some other subdomains that I know exist on CP

[connormaglynn]

🆙 Update

• Have now gathered metrics on delegations across all Hosted Zones within the DSD account 👇 which satisfies the tasks to be completed ✅
• A more detailed view of delegations can be found attached this this slack message

JSON Data of Delegation 📊

```json { "delegations": [ { "type": "ACCOUNT", "name": "DSD", "totals": { "all": [ 219, "100%" ], "to_unknown": [ 130, "59%" ], "to_cloud_platform": [ 63, "29%" ], "to_dsd": [ 26, "12%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - dsd.io.", "totals": { "all": [ 39, "100%" ], "to_unknown": [ 36, "92%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 3, "8%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - courttribunalformfinder.service.gov.uk.", "totals": { "all": [ 1, "100%" ], "to_unknown": [ 1, "100%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - cjsm.justice.gov.uk.", "totals": { "all": [ 2, "100%" ], "to_unknown": [ 2, "100%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - et.dsd.io.", "totals": { "all": [ 1, "100%" ], "to_unknown": [ 1, "100%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - service.justice.gov.uk.", "totals": { "all": [ 112, "100%" ], "to_unknown": [ 61, "54%" ], "to_cloud_platform": [ 50, "45%" ], "to_dsd": [ 1, "1%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - civillegaladvice.service.gov.uk.", "totals": { "all": [ 2, "100%" ], "to_unknown": [ 0, "0%" ], "to_cloud_platform": [ 2, "100%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - judiciary.gov.uk.", "totals": { "all": [ 2, "100%" ], "to_unknown": [ 0, "0%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 2, "100%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - test.justice.gov.uk.", "totals": { "all": [ 1, "100%" ], "to_unknown": [ 0, "0%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 1, "100%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - justice.gov.uk.", "totals": { "all": [ 51, "100%" ], "to_unknown": [ 23, "45%" ], "to_cloud_platform": [ 10, "20%" ], "to_dsd": [ 18, "35%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - courtfunds.gov.uk.", "totals": { "all": [ 1, "100%" ], "to_unknown": [ 0, "0%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 1, "100%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - judiciary.uk.", "totals": { "all": [ 3, "100%" ], "to_unknown": [ 2, "67%" ], "to_cloud_platform": [ 1, "33%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - yjb.gov.uk.", "totals": { "all": [ 3, "100%" ], "to_unknown": [ 3, "100%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 0, "0%" ] } }, { "type": "HOSTED_ZONES", "name": "DSD - publicguardian.gov.uk.", "totals": { "all": [ 1, "100%" ], "to_unknown": [ 1, "100%" ], "to_cloud_platform": [ 0, "0%" ], "to_dsd": [ 0, "0%" ] } } ] } ```

👀 Remaining Work

• 🧪 Add some unit tests
• 🥳 Merge in code to main

📝 Notes

• Delegations are considered any NS record in a HostedZone where the Record Name is not the HostedZone Name. CNAME records are also delegations, but these have been omitted from the scope of this work

[AntonyBishop]

Actually we have a ticket for next sprint about metrics for DNS. Unknown delegations sounds like a good metric to drive down to show improvement in management and security of the estate.

[connormaglynn]

🆙 Update

• Tests for the code now added and merged into main on this PR https://github.com/ministryofjustice/operations-engineering/pull/4673

👀 Remaining Work

• All done, closing ticket ✅

📝 Notes

• As @AntonyBishop mentioned, this work can be used for this ticket https://github.com/ministryofjustice/operations-engineering/issues/4604
• Also capturing these metrics as part of the KPI dashboard may be useful, as part of this ticket https://github.com/ministryofjustice/operations-engineering/issues/4612