DNS Pipeline Teardown Controls: Keeping Destructive Zone Changes Reviewable

说明与用途

CI/CD 中的 DNS 破坏性操作控制：使用域名白名单，默认删除记录，单独请求删除区域并记录审计日志。

问题

Automated DNS pipelines risk accidental zone deletion when a variable is empty or mis‑configured, leading to loss of mail, TXT, and service discovery records.

结果

By enforcing an allowlist, defaulting to record deletion, and logging intent, the pipeline prevents accidental zone wipes while still enabling rapid, intentional teardowns.

工作流

• 1. Define a domain allowlist in the pipeline configuration.
• 2. Before any DNS call, check that the target domain is in the allowlist.
• 3. Log an audit event with action, domain, actor, run ID, and reason.
• 4. For cleanup jobs, call the record‑delete endpoint; for explicit teardown, call the zone‑delete endpoint after separate review.
• 5. Use a small request body that contains only the capability schema fields.
• 6. Handle rate‑limiting with exponential backoff and idempotency keys.

证据

To prevent accidental DNS zone deletion in an automated pipeline, require an explicit domain allowlist and make record deletion the default destructive operation.

来源

Log intent first. A small audit event containing the action, domain, actor, pipeline run ID, and reason gives the successful destructive action a trail that can be correlated later.

来源