gcloud-dnssec-keysigning-rsasha1: DNSSEC RSASHA1 Algorithm Deprecated Usage

id: gcloud-dnssec-keysigning-rsasha1

info:
  name: DNSSEC RSASHA1 Algorithm Deprecated Usage
  author: princechaddha
  severity: medium
  description: |
    Ensure that Domain Name System Security Extensions (DNSSEC) feature is not using the deprecated RSASHA1 algorithm for the Key-Signing Key (KSK) associated with your DNS managed zone file.
  impact: |
    Using the deprecated RSASHA1 algorithm in DNSSEC configurations can expose DNS infrastructure to vulnerabilities and compromise the integrity and security of DNS data.
  remediation: |
    Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
  reference:
    - https://cloud.google.com/dns/docs/dnssec-config
  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let managedZone of iterate(template.managedZones)){
      set("managedZone", managedZone)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud dns managed-zones list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: managedZones
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud dns managed-zones describe $managedZone --project $projectId --format="json(dnssecConfig)"

    matchers:
      - type: word
        words:
          - 'rsasha1'

    extractors:
      - type: dsl
        dsl:
          - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950