Delete a DNS Record in a Hosted Zone with the AWS CLI

ACM.249 It’s not as simple as you might imagine (as far as I know at the time of this writing)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: Application Security | Deploying a Static Website | DNS

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I got sucked into this rabbit hole trying to redeploy a TLS Certificate and the CNAME used to validate it so I wrote about that in my last post.

Back to my S3 bucket attempt I just wanted to delete the CloudFormation stack for the CNAME which is now in a failed state and the underlying DNS record. I wrote about those complications here, where I started a function to delete a DNS record:

But that turned into a significant amount of time as well so now you get this post — how to delete a DNS record using the AWS CLI.

I based my initial function on what I wrote about in this post — using the AWS CLI to create a record in a route 53 hosted zone, and I later changed this to update a record as well.

I figured I probably only needed the ame of the record right? Why would I need the rest of the information just to delete it?

That assumption turned out to be incorrect.

Got this error trying to delete a CNAME record in AWS Route53.

An error occurred (InvalidInput) when calling the ChangeResourceRecordSets operation: Invalid request: Expected exactly one of [AliasTarget, all of [TTL, and ResourceRecords], or TrafficPolicyInstanceId], but found none in Change with [Action=DELETE, Name=x., Type=CNAME, SetIdentifier=null]

Looking at this:

Well this sounds complicated and not cool but I don’t think this applies to me:

To delete the resource record set that is associated with a traffic policy instance, use DeleteTrafficPolicyInstance . Route 53 will delete the resource record set automatically. If you delete the resource record set by using ChangeResourceRecordSets , Route 53 doesn't automatically delete the traffic policy instance, and you'll continue to be charged for it even though it's no longer in use.

I’m essentially trying to do this, but I left off the value. Why do I have to provide a value when I’m deleting the record??

So anyway let’s add back in the value and see if it works.

Next up I get this:

An error occurred (InvalidChangeBatch) when calling the ChangeResourceRecordSets operation: [Tried to delete resource record set [name=’_0d416a0c2c8b704e3e6866edc148b016.dev.rainierrhododendrons.com.’, type=’CNAME’] but the values provided do not match the current values]

Hmm?

Here’s what I’m providing to the CLI:

Here’s an export:

Specifically:

_0d416a0c2c8b704e3e6866edc148b016.dev.rainierrhododendrons.com. 300 CNAME _5aae181072984dfc69a7bd99991f5245.vrcmzfbvtx.acm-validations.aws.

Looks right to me???

Oh wait — the TTL has to match too?

Ok……

Finally:

Here’s the whole function:

If I have more than one value do I have to provide all of them? Because that makes this much more complicated. Check my prior post where I’m creating an NS record. I have a bunch of name servers and I have to provide all the key value pairs in separate curly braces. That means I can’t just pass in a value to this existing function. I would need to modify the above function to accept all of that and then calculate the values in curly braces externally and pass them in.

There must be a better way, no?

I wish AWS would remove the requirement to pass in anything except the record name on delete.

But really what I want is to fix CloudFormation so it deletes the record when I delete the stack. 🙏 😁

And…it’s not really even done because I have to check if the record exists before trying to delete it…

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab