DNS Logging

[aumohr]

Describe the bug
None of the auto-generated Shared VPCs have a DNS Policy with DNS logging in place. To activate DNS logging is considered a security best practice to discover and investigate security events.

Rational
Cloud DNS logging records the queries coming from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC to Cloud Logging.

DNS logs can be used to investigate attacks and detect threats. Security Command Center Event Threat Detection requires Cloud DNS logs to detect some threats.

Recommendation
Cloud DNS logging is one of the sources for the Event Threat Detection. If you activate Security Command Center Premium tier at the organization level, Event Threat Detection consumes logs for your projects as they are created. Enable Cloud DNS logging by attaching a DNS policy with logging enabled to all VPC networks. To capture public DNS queries, logging must be enabled on public zones.

Expected behavior
The default configuration should have a DNS Policy configured to log DNS requests. There can be an option to opt-out to reduce costs.

[ludoo]

Reopening the issue, I am getting this error applying the peering network stage in my org

[ludoo]

The error derives from enabling inbound DNS at the VPC level via the ne-vpc module. Wasn't all the e2e testing supposed to catch this? :)

I see two ways to handle this

• move DNS inbound policy out of net vpc and into the DNS module
• handle DNS logging at the net vpc level

My strong preference is for the second, since we care about VPCs in DNS policies not zones, which is what the DNS module handles. DNS policy should be handled at the module level and not as a FAST resource, to prevent this kind of conflicts.

FAST is currently broken, so this needs to be fixed ASAP.

[ludoo]

Well, DNS logging is already in the net-vpc module

[ludoo]

Closing as #2041 addressed this.

[wiktorn]

The error derives from enabling inbound DNS at the VPC level via the ne-vpc module. Wasn't all the e2e testing supposed to catch this? :)

@ludoo They did catch this, though mail notification failed :-(