How to allow workloads to manage their own DNS entries when running on VMs joined to an Azure AD Domain Services (AADDS) domain?

Colin Smith 0
Viewed 51

How can we allow application workloads to manage their own DNS entries when their VMs also need to be joined to an AADDS domain (without violating the principal of least privilege)?

Background

We have the following network configuration:

  1. A Hub VNET containing an Azure AD Domain Services (AADDS) managed domain called mydomain.co.uk. This VNET will also host a VNET Gateway, a Bastion instance and a couple of management VMs.
  2. Multiple "environment" VNETs, all peered to the Hub, to run application workloads. These workloads all currently running on on domain-joined VMs & VMSSs that are behind both an Standard Load Balancer (for internal traffic), and an Application Gateway (for public traffic). The IP addresses of those load balancers and App Gateways need to be resolvable via DNS.

Requirements

We would like all applications to be resolvable using the same TLD domain - both internally and externally (e.g. myapp.env1.mydomain.co.uk should work internally and externally).

The Hub is created by a single pipeline running a terraform configuration that is maintained by the Platform team. The platform Team should not need to be involved when provisioning environments.

Each environment is created by its own pipeline, running terraform configurations that are maintained by the various Product Teams. The Product Teams should be able to spin up & destroy environments without any input from the Platform Team.

Problem

Public DNS resolution was easy to setup. We simply granted each environmental pipeline permission to register records in an Azure public DNS zone. The problem arose when we tried to solve internal DNS Resolution.

We tried creating a Private DNS zone for `mydomain.co.uk and linking it to the environmental VNETs. Unfortunately, the VMs in those VNETs then fail to join to the domain due to the lack of domain SRV records (these are created by default in AADDS). So it seems that AADDS requires that any VNETs containing VMs that want to join to the domain use its IP addresses for DNS resolution. This means any apps running on those VMs must send their DNS query to AADDS, not to an Azure Private DNS Zone.

We thought about giving the environment pipelines permission to create records in the AADDS DNS zone. Unfortunately, the Microsoft docs say that only users that are members of the "AAD DC Administrators" group can add/remove DNS records. This is far too much power to give to the environmental pipelines (it would allow them to delete other workloads' VMs from the domain for example).

We then tried linking the Private DNS zone to the Hub VNET, in the hope that we could configure AADDS to forward any DNS requests that it can't resolve to Azure DNS. Unfortunately, AADDS does not forward any DNS requests for mydomain.co.uk onto Azure DNS - presumably because it believes it is authoritative for that zone.

Is there another mechanism that we haven't thought of yet?

dns active-directory azure
1 Answers

• Since, you want the app workloads running on VMs in the spoke virtual network to search or forward the DNS requests from the Azure private DNS zone to the AADDS, you can surely leverage the functionality of conditional forwarder in this regard. Thus, to use this functionality, you would need to configure a VM as a ‘Domain Controller’ for this managed domain and associate it in a subnet that is reachable to all the domain joined resources in the hub and spoke virtual network model.

To join a VM to a managed domain and configure it as a ‘Domain Controller’ for serving the full features of ADDS and DNS, kindly refer to the below link for more details: -

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns#before-you-begin

Also, to configure the conditional forwarder in AADDS joined VM configured as a DC, ensure to install DNS Server tools, and use the DNS console to manage the records in AADDS as well as follow the steps below to configure a conditional forwarder in the AADDS VM: -

a) Login to a VM and open the ‘Administrative Tools’ --> ‘DNS’ --> DNS Management Console opens --> Connect to DNS Server dialog

b) Select Conditional Forwarders, then right select and choose New Conditional Forwarder --> enter the other DNS domain such as for example, ‘contoso.com’, then enter the IP addresses of the DNS servers for that namespace as shown below: -

AADDS Conditional Forwarder

c) Check the box for Store this conditional forwarder in Active Directory, and replicate it as follows, then select the option for ‘All DNS servers in this domain’, as shown in the following example: -

‘Conditional forwarder should be stored in the domain, not in the forest’

Conditional forwarder

d) Name resolution of the resources in other namespaces from VMs connected to the managed domain should now resolve correctly. Queries for the DNS domain configured in the conditional forwarder are passed to the relevant DNS servers (Azure private DNS zone) and from there, the Azure VMs mapped or registered in there will be forwarded the DNS requests accordingly.

Thus, in this way, if you configure AADDS to forward any DNS requests to the Azure private DNS zone with the help of conditional forwarder, you would be able to forward the DNS requests for ‘mydomain.co.uk’ to the Azure private DNS zone for further resolution.

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns#create-conditional-forwarders

Kartik Bhiwapurkar0
Related