GCP Terraform Misconfiguration: Weak Cryptographic Cloud DNS Signature

A Terraform configuration enables the Domain Name System Security (DNSSEC) of a Cloud DNS Domain with an insecure signing algorithm.

DNSSEC prevents DNS spoofing by providing the ability to use digital signatures for DNS response validation. Any DNSSEC signing algorithm that uses SHA-1, however, is susceptible to an ever-growing risk of attack. SHA-1 is no longer considered a secure hash algorithm when used with digital signatures.

Example 1: The following example shows a Terraform configuration that enables the DNSSEC with the insecure signing algorithm rsasha1.

resource "google_dns_managed_zone" "zone-demo" {
...
  dnssec_config {
    default_key_specs {
      algorithm = "rsasha1"
      ...
    }
  }
...
}