Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dns zone locking to production checklist #370

Merged
merged 1 commit into from
Feb 6, 2025
+15 −1
Merged

Add dns zone locking to production checklist #370

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion documentation/production-checklist.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,10 +132,24 @@ The new service template uses the default "Teacher services cloud" value for the
Optional but recommended for user facing services. See [Maintenance page](maintenance-page.md) for more details.

## Lock critical resources
Add a lock to critical Azure resources to prevent against accidental deletion, such as production databases. Members of the `s189-teacher-services-cloud-ResLock Admin` Entra ID group (infra team) can manage locks.
Add a lock to critical Azure resources to prevent against accidental deletion.
We currently create locks for two types of resources.
(Members of the `s189-teacher-services-cloud-ResLock Admin` Entra ID group (infra team) can manage locks.)

1. Production database servers.
- Open the resource in the Azure portal
- Settings > Locks > + Add > Lock name: Delete, Lock type: Delete > OK

2. DNS zones.
We lock the SOA record in the zone as this prevents zone deletion while enabling records to be added, deleted and updated.
Currently, this type of lock can only be added via powershell, but it can be removed via powershell or the portal.
```
Connect-AzAccount
New-AzResourceLock -LockLevel "CanNotDelete" -LockName "s189p01-<SERVICE_SHORT>-lock" -ResourceName "<DNS_ZONE_NAME>/@" -ResourceType "Microsoft.Network/DNSZones/SOA" -ResourceGroupName "<DOMAINS_RESOURCE_GROUP_NAME>"
e.g.
New-AzResourceLock -LockLevel "CanNotDelete" -LockName "s189p01-att-lock" -ResourceName "apply-for-teacher-training.education.gov.uk/@" -ResourceType "Microsoft.Network/DNSZones/SOA" -ResourceGroupName "s189p01-applydomains-rg"
```

## Build image security scanning
We use SNYK scanning to [check build images for vulnerabilities](https://educationgovuk.sharepoint.com/sites/teacher-services-infrastructure/SitePages/Testing-software.aspx).

Expand Down