DNS Pipeline Teardown Controls: Keeping Destructive Zone Changes Reviewable

Описание и применение

Контроль разрушительных операций DNS в CI/CD: использование списка разрешенных доменов, по умолчанию удаление записей и отдельный запрос на удаление зоны с журналом действий.

Задача

Automated DNS pipelines risk accidental zone deletion when a variable is empty or mis‑configured, leading to loss of mail, TXT, and service discovery records.

Результат

By enforcing an allowlist, defaulting to record deletion, and logging intent, the pipeline prevents accidental zone wipes while still enabling rapid, intentional teardowns.

Рабочий процесс

• 1. Define a domain allowlist in the pipeline configuration.
• 2. Before any DNS call, check that the target domain is in the allowlist.
• 3. Log an audit event with action, domain, actor, run ID, and reason.
• 4. For cleanup jobs, call the record‑delete endpoint; for explicit teardown, call the zone‑delete endpoint after separate review.
• 5. Use a small request body that contains only the capability schema fields.
• 6. Handle rate‑limiting with exponential backoff and idempotency keys.

Доказательства

To prevent accidental DNS zone deletion in an automated pipeline, require an explicit domain allowlist and make record deletion the default destructive operation.

Источник

Log intent first. A small audit event containing the action, domain, actor, pipeline run ID, and reason gives the successful destructive action a trail that can be correlated later.

Источник