Network namespace monitoring system
A namespace monitoring service may track released namespaces such as internet protocol (IP) addresses and manage namespace cooldown pools, available namespace pools, and a registry of released namespaces to detect and mitigate security vulnerabilities that arise from reassignment of namespaces. The namespace monitoring service provides access to the released namespace registry and/or sends a data stream of namespace registry updates. The namespace monitoring service may manage namespace reassignment process and extend the cooldown period of released namespaces or place a hold on available namespaces.
1. A system, comprising:
one or more computing devices, respectively comprising at least one processor and a memory that implement a dangling domain name system (DNS) pointer detection system, configured to:
monitor respective unbinding of DNS domain names of resources hosted in a provider network;
determine a list of unbound DNS domain names using the dangling DNS pointer detection system, wherein the list includes the DNS domain names that were previously bound to the resources hosted in the provider network;
identify, based on the list of unbound DNS domain names, one or more dangling DNS domain names;
send an alert indicating the one or more dangling DNS domain names based on the identification of the one or more dangling DNS domain names; and
prevent the one or more dangling DNS domain names from being bound to new resources without receipt of approval associated with an account of the provider network previously associated with the one or more dangling DNS domain names.
2. The system of claim 1 , wherein the dangling DNS pointer detection system is further configured to:
receive, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
the alert indicating the one or more dangling DNS domain names is sent to a reporting destination determined in accordance with the request.
3. The system of claim 1 , wherein the dangling DNS pointer detection system is further configured to:
receive, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
wherein the prevention of the one or more dangling DNS domain names from being bound to the new resources is based on the request for access to the list.
4. The system of claim 1 , wherein the dangling DNS pointer detection system is further configured to:
receive, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
extend, based on the request for access to the list, a period required before the one or more dangling DNS domain names are available to be bound to the new resources.
5. The system of claim 1 , wherein the unbound DNS domain names are unbound names of containers for objects stored using a cloud storage service, wherein the unbound names of containers have been previously bound to the resources hosted in the provider network.
6. The system of claim 1 , wherein the dangling DNS pointer detection system is further configured to:
process one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the unbound DNS domain names to determine a threat level of the unbound DNS domain names.
7. The system of claim 1 , wherein the dangling DNS pointer detection system is further configured to:
process one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the DNS domain names to initiate an incident workflow.
8. A method, comprising:
monitoring, by a dangling domain name system (DNS) pointer detection system, respective unbinding of DNS domain names of resources hosted in a provider network;
determining a list of unbound DNS domain names using the dangling DNS pointer detection system, wherein the list includes the DNS domain names that were previously bound to the resources hosted in the provider network;
identifying, based on the list of unbound DNS domain names, one or more dangling DNS domain names;
sending an alert indicating the one or more dangling DNS domain names based on the identification of the one or more dangling DNS domain names; and
preventing the one or more dangling DNS domain names from being bound to new resources without receipt of approval associated with an account of the provider network previously associated with the one or more dangling DNS domain names.
9. The method of claim 8 , wherein the method further comprises:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
the alert indicating the one or more dangling DNS domain names is sent to a reporting destination determined in accordance with the request.
10. The method of claim 8 , wherein the method further comprises:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
wherein the preventing the one or more dangling DNS domain names from being bound to the new resources is based on the request for access to the list.
11. The method of claim 8 , wherein the method further comprises:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
extending, based on the request for access to the list, a period required before the one or more dangling DNS domain names are available to be bound to the new resources.
12. The method of claim 8 , wherein the unbound DNS domain names are unbound names of containers for objects stored using a cloud storage service, wherein the unbound names of containers have been previously bound to the resources hosted in the provider network.
13. The method of claim 8 , wherein the method further comprises:
processing one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the unbound DNS domain names to determine a threat level of the unbound DNS domain names.
14. The method of claim 8 , wherein the method further comprises:
processing one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the DNS domain names to initiate an incident workflow.
15. One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement a dangling domain name system (DNS) pointer detection system that implements:
monitoring, by a dangling DNS pointer detection system, respective unbinding of DNS domain names of resources hosted in a provider network;
determining a list of unbound DNS domain names using the dangling DNS pointer detection system, wherein the list includes the DNS domain names that were previously bound to the resources hosted in the provider network;
identifying, based on the list of unbound DNS domain names, one or more dangling DNS domain names;
sending an alert indicating the one or more dangling DNS domain names based on the identification of the one or more dangling DNS domain names; and
preventing the one or more dangling DNS domain names from being bound to new resources without receipt of approval associated with an account of the provider network previously associated with the one or more dangling DNS domain names.
16. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the storage media further comprise additional program instructions that, when executed on or across the one or more computing devices, causes the dangling DNS pointer detection system to implement:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
the alert indicating the one or more dangling DNS domain names is sent to a reporting destination determined in accordance with the request.
17. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the storage media further comprise additional program instructions that, when executed on or across the one or more computing devices, causes the dangling DNS pointer detection system to implement:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
wherein the preventing the one or more dangling DNS domain names from being bound to the new resources is based on the request for access to the list.
18. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the storage media further comprise additional program instructions that, when executed on or across the one or more computing devices, causes the dangling DNS pointer detection system to implement:
receiving, via an interface of the dangling DNS pointer detection system, a request for access to the list of unbound DNS domain names, wherein:
the request for access to the list enables monitoring of respective unbinding of DNS domain names for resources associated with the account of the provider network; and
extending, based on the request for access to the list, a period required before the one or more dangling DNS domain names are available to be bound to the new resources.
19. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the storage media further comprise additional program instructions that, when executed on or across the one or more computing devices, causes the dangling DNS pointer detection system to implement:
processing one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the unbound DNS domain names to determine a threat level of the unbound DNS domain names.
20. The one or more non-transitory, computer-readable storage media of claim 15 , wherein the storage media further comprise additional program instructions that, when executed on or across the one or more computing devices, causes the dangling DNS pointer detection system to implement:
processing one or more of the respective unbinding of DNS domain names bound to the resources hosted in the provider network and associated data of the DNS domain names to initiate an incident workflow.