Production Cloud Account (AWS/GCP/Azure) anyi Domain Suspended: Immediate Escalation and Failover¶

Kujuka ku binunu bia madimuija a PagerDuty ne mabikila a bakiliya bualu site webe mujima wa dienza dia bintu, programe wa SaaS, API, ne kumpanyi @yourcompany.com e-mail mmujimine musangu umua pa lutanda lua Internet (ki mbua bualu bua tshilema tshia kode to, kadi bualu mufundi wa domaine webe mmuteke clientHold dikanga dia tshitupa tshieba tshia kumpala anyi AWS, Google Cloud (GCP), anyi Microsoft Azure uvua muimanyike mudimu webe wa ditutu) mbualu bua tshimpitshimpi budi buenzeka. Dituku dionso, midimu idi ifila makuta itu ipeta dijimija dia nzembu bualu karte ka mfranga ka muena mudimu kampanda ka kale kadi kajika, tshiamu tshia mudimu tshidi tshiluisha dishima tshidi tshileja PDF mu tshibombi tshia S3, ICANN WHOIS registrant email udi kayi mujadikibue udi upingana panyima pa matuku 15, anyi key IAM udi mupatuke kayi muenze mudimu ne tshiamu tshia crypto uvua mupangile tshiamu tshia dishima tshia mufidi wa bintu bia mu matutu.

Bikala tshitupa tshieba tshia mudimu anyi tshiamu tshieba tshia mu matutu tshidi tshikuatshisha telemetrie ya malu a bukola bua mubidi, dituma dia malu a tshimpitshimpi, anyi mishindu ya bukubi bua bantu bonso, enza diakamue mudimu wa dipanga dia bintu bia muaba unudi ne manyisha bena mudimu ba malu a tshimpitshimpi pikala bukubi bua bantu buenzeke (bikila 911 mu États-Unis ne mu Canada, 112 mu Union européenne mujima, mu Royaume-Uni 1999; nomba ya tshimpitshimpi). Bua bilumbu bia malu a tekiniki ne bia mudimu bia muomumue, bala ndongamu wa kutungunuka ne mudimu ne dilongolola dia malu kunyima kua bipupu, ransomware ya mudimu ne dishipa dia tshiamu tshia mudimu, ne muaba wa dipanyishila bintu (POS) udi mupangile ne internet udi mupangile.

Enza nunku mpindieu¶

1. Nyema 10-sekonde whois ne dig +trace kukeba ku terminal bua kumanya ni dina diebe dia domaine (clientHold) anyi konte weba wa Cloud Hosting (AWS/GCP/Azure) ke uvua munyanguke. Kujimiji minite 45 bua kulongolola bisumbu bia Kubernetes anyi biamu bia mudimu bia mu matutu padi mufundi wa domaine mukuate nameserver yebe. Kunyema lubilu whois yourdomain.com | grep -i "status": wewa mumone clientHold, serverHold, redemptionPeriod, anyi name servers mishintuluke ku sedoparking.com / verification-hold.suspended-domain.com, biamu bieba bia mudimu bia mu matutu bidi anu bienda bimpa, ne dipanga dia mudimu didi 100 pa lukama ku Mulongo wa Domain Registrar.
2. Umbusha dimanyisha diebe dia malu a tshimpitshimpi ku tshiamu tshieba tshia kumpala @yourcompany.com e-mail diakamue. Padi domaine webe wa kumpala muimanyika anyi muteka pa clientHold, email yonso ya MX idi ibuela kudi @yourcompany.com bounces, kubadila'mo ma e-mail a kupingaja meyi a tshisokomenu, kode ya 2FA ya kujadika, ne tike ya diandamuna ya kudi mufundi wa kazubu kebe ne AWS Trust & Safety. Tangila diakamue ni konte webe wa registrar anyi wa cloud root mmusuika kudi @yourcompany.com adrese wa e-mail; bikalabi nanku, ufila tshitupa tshia pambelu pa tshisumbu @gmail.com anyi adrese wa domaine muibidi pa tike yonso wa diambuluisha ne dibikila dia ku telefone.
3. Bikala tshitupa tshieba tshidi pa clientHold bua mukanda wa ICANN WHOIS udi kauyi mujadikibue (mukenji wa matuku 15), tuaku pa tshimanyinu tshia dijadika anyi ushintulule mukanda wa mufundi mu tshibuelelu tshia mufundi. Muinshi mua ICANN 2013 Registrar Accreditation Agreement (RAA) Whois Accuracy Specification, pikala mufundi mupangile bua kupetangana ne e-mail wa dijadika mu matuku 15 wa disumba dia domaine, dituma, anyi dishintulula dia malanda, mufundi udi muenzejibue bilondeshile mikenji bua kuteka domaine pa clientHold (kuteka DNS). Kutuma kabidi ne kututa pa kazubu ka e-mail kamue kudi kumbusha clientHold mu minite 15 too ne ku 60.
4. Bikala domaine webe muimanyibua kudi Registrar "Abuse / Trust & Safety" bua dishima, dinyanguka dia programe, anyi dinyanguka dia tshimanyinu tshia mudimu, KUANDAMI anu ku mulongo wa tike ya dinyanguka dia bintu. Milongo ya email ya pa tshibidilu ku GoDaddy, Namecheap, Tucows/Enom, Cloudflare, ne Network Cloud idi ilomba mêba 24.27 Diakamue: (a) umbusha anyi utapulula URL/upload wa muntu udi wenza bibi udibu baleje mu dilomba, (b) utume Abuse Cure Proof + False-Positive Escalation ku diambuluisha dia tshiamu tshia mudimu tshia muena mudimu wa telefone/chat abuse desk, ne © kuenza diakamue Secondary Mirror Domain (yourcompany.co anyi yourcompany-app.com) nunku bakiliya ne ba API badi mua kutungunuka ne kuenza mudimu padi DNS wenda utangalaka.
5. Bikala AWS, GCP, anyi Azure muimanyike konte weba wa dienza dia bintu mu matutu bua dipanga dia difuta dia bitadi, futa makuta adi mashale ne karte ka banke ka pa mutu anyi wire/ACH ne unzulule tike wa dipingaja dia bitadi bia mushinga mukole. Kukangula konte mupiamupia wa AWS/GCP ne teta bua kumbusha konte ya dilama dia bintu idi kayiyiku: 10 pa lukama lua mikanda yebe ya EBS, ya RDS, ne ya S3 buckets mu tshitupa tshia mashika munkatshi mua matuku 30 too ne ku 90 kumpala kua dijimija dia kashidi. Kufuta makuta adi mapite pa dîba mu Root Billing Console kudi kuenza bua se mudimu ikale mu minite 15 too ne ku meba 4.
6. Bikala AWS, GCP, anyi Azure mikandika konte webe bua "Acceptable Use Policy (AUP) / Trust & Safety / Compromised IAM Key" dishipa dia mikenji, shintulula IAM key yonso diakamue ne wandamune ku Case ID menemene mu Root Support Center. Bisumbu bia Cloud Trust & Safety kabiakumbusha kumbusha nansha kakese too ne paudi ujadika ne: dipanga dia bukubi didi dijika: tshifungu tshia kubuela tshidi tshipatuka, kujikija bilumbu bionso bia EC2/Compute Engine crypto-mining, kuenza bua MFA ikaleku pa muena mudimu wa Root, ne kulamakaja Root-Cause & Remediation Report ku tshilumbu tshia diambuluisha dia Trust & Safety.

Mutshi wa mapangadika: Dikonkonona ne dijikija dia tshitupa tshia mudimu anyi diimanyika dia matutu¶

flowchart TD
    Start["MUSHINDU WA KUENZA MUDIMU: Site wa Enternete, API, ne Email wa kumpanyi mupueka"] --> Diag["Enza 10-Second Terminal Diagnosis: whois yourdomain.com NE dig +trace yourdomain.com"]

    Diag -->|"WHOIS udi uleja clientHold, serverHold, redemptionPeriod, anyi parked NS"| DomainCrisis{"Ntshinyi tshivua tshikebeshe diimanyika dia Domain Registrar?"}

    DomainCrisis -->|"1. ICANN 15-Day WHOIS Email Verification Failure"| ICANNFix["Buela mu Registrar -> Tuma kabidi RAA Verification Email (anyi ushintulule Registrant ku Gmail udi wenza mudimu) -> Fina pa link -> Live in 15 to 60 min"]
    DomainCrisis -->|"2. Domaine udi mujika / Carte de crédit auto-renouvele udi mupangile"| RenewFix["Futa bitadi bia dipingaja (ne $80-$250 bitadi bia dipikula pikala matuku 30+ mapite) -> Pingaja Nameservers ya kale -> Sumbusha DNS wa bantu bonso"]
    DomainCrisis -->|"3. Dinyanguka dia bafundi / Dishima / Diimanyika dia programe ya malu mabi"| AbuseFix["1. Umbusha URL/mukanda udibu baleje pa tshiamu tshia mudimu 2. Mukanda udi ne tshijadiki tshia dishima / tshidi tshilongolola ne Registrar Trust & Safety 3. Enza mudimu ne Secondary Failover Domain"]

    Diag -->|"DNS wa tshitupa udi ujikija bimpa, kadi Cloud IPs/Console udi upingaja konte mukanga"| CloudCrisis{"Bua tshinyi AWS / GCP / Azure uvua muimanyike Cloud Tenant?"}

    CloudCrisis -->|"1. Dipanga dia difuta dia bitadi (Karte ka kale / Banke ACH Reject / Limit Hit)"| CloudBill["1. Buela bu Root User / Billing Admin 2. Weja karte ka mfranga kapiakapia anyi karte ka backup ne tuaku pa 'Teta kufuta kabidi' 3. Fungula Billing Reactivation Support Case"]
    CloudCrisis -->|"2. IAM Key / Rogue Crypto-Mining Spend Spike"| CloudSec["1. Kudimuna/Kumbusha IAM Access Keys idi mipatuke 2. Kujikija malu mabi ne kuenzeja Root MFA 3. Kuandamuna ku Trust & Safety Case + kulomba Spend Waiver"]
    CloudCrisis -->|"3. Dishima dia bantu bakuabu / DMCA / AUP Abuse Flag pa S3 / VM"| CloudAUP["1. Kutapulula anyi kumbusha tshintu tshia S3 / VM IP 2. Diandamuna ku AWS/GCP Trust & Safety Case ID ne WAF/Upload guardrails"]

Tshitupa 1: Tshikebelu tshia minite isatu (Mmufundi wa tshitupa, DNS, anyi mufidi wa bintu bia mu matutu anyi?)¶

Padi dilomba diebe dia mudimu dienda dinyanguka ne bena mudimu bela mbila ne: "bionso mbinyanguke, nansha e-mail wetu," kuela meji to. Enza mudimu ne meyi asatu aa ku tshiamu tshionso tshia ordinatere (macOS, Linux, anyi Windows WSL/PowerShell) bua kumanya tshitupa tshilelela tshivua tshikutekeshe.

1. Dîyi dia kumpala: Tangila meyi a nsombelu wa ICANN Extensible Provisioning Protocol (EPP)¶

Kunyema lubilu:

whois yourdomain.com | grep -E -i "Status|Name Server|Expiry"

Tshitupa 2: Dijikija dia diimanyika dia Domain Registrar (clientHold / Abuse / ICANN Lock)¶

Shi whois Tangila bidi bileja clientHold anyi nameservers mimane, londa njila wa dipingaja udi kuinshi eku.

Njila A: Kumbusha tshilumbu tshia ICANN WHOIS tshia dijadika dia e-mail (15-Minute Fix)¶

Muinshi mua ICANN 2013 RAA Whois Accuracy Program, dîba dionso diudi ufunda tshitupa tshipiatshipia, ushintulula tshitupa, anyi ushintulula dina dia kumpala, dia ndekelu, anyi adrese wa e-mail, mufundi udi utuma mukanda wa dilomba udi ne tshiena bualu tshia ne: "IMMEDIATE VERIFICATION required for yourdomain.com." 1. Buela mu kazubu kebe ka dilombola dia domaine. Tshimanyinu tshikunze tshidi ku mutu kua tshibuelelu netshikale tshiamba ne: "Tshitupa etshi ntshiimanyika too ne padi ICANN Whois ujadika." 2. Buteyi bua Catch-22: Shi mukanda wa mufundi udi mu mukanda udi admin@yourdomain.com, kuena mua kupeta mukanda wa dianyisha bualu yourdomain.com udi muimanyika mpindieu. 3. Tshia kujikija: Munda mua tshitupa tshia Domain Contact / WHOIS tshia mufundi, shintulula Adrese wa e-mail wa mufundi ku adrese wa pambelu udi wenza mudimu (bu mudi @gmail.com adrese uudi ukokesha), lama tshiudi mushintulule, tuaku pa "Tuma kabidi e-mail wa dijadika," kangula kazubu ka Gmail, ne tuaku pa tshimanyinu tshia dijadika. 4. API wa mufundi udi wenza mudimu nkayende udi utuma diakamue EPP update diumusha dia dîyi clientHold ku Verisign/Registry root zone mu 5 to ne 20 minutes.

Track B: Kumbusha "Abuse / Phishing / Malware / AUP" wa muena mudimu¶

Lelu, bafundi banene ba domaine (Namecheap, GoDaddy, Tucows/Enom/OpenSRS, Porkbun, Cloudflare Registrar, Squarespace Domains) badi badifundisha ku malu a njiwu (Netcraft, PhishTank, Spamhaus, Google Safe Browsing, AbuseIPDB). Bikala muena tshinyangu mubuele mu tshiamu tshia WordPress mu tshitupa tshia mudimu tshidibu bapue muoyo (promo.yourdomain.com), anyi pikala muena mudimu muele PDF wa dishima mu tshibombi tshia malu a muena mudimu tshia SaaS app webe (cdn.yourdomain.com/uploads/invoice.pdf), bot udi wenza mudimu nkayende udi utuma Tier-1 Phishing Takedown Notice kudi mufundi webe, ne muena mudimu udi utangila malu a mikenji udi uteka domaine webe mujima wa muji (yourdomain.com) pa clientHold.

Dibandisha dia tshitupa ku tshitupa bua kupeta clientHold mubandishibue mu mêba pamutu pa matuku¶

1. Keba tshikandakanda tshia tshinyangu tshilelela ne URL mufunda:
2. Tangila kazubu ka e-mail kadi mu kazubu kebe ka mufundi (ne muena mudimu wa WHOIS Abuse) bua kupeta e-mail wa kudi abuse@, legal@, anyi compliance@[registrar].com.
3. Keba URL mulelela anyi adrese wa IP udibu baleje mu luapolo lua malu mabi.
4. Ulongolole anyi utapulule tshintu tshidibu baleje diakamue:
5. Nansha mudi dilomba dikale dia dishima (tshilejilu, dibeji diebe dia mudimu dia Single Sign-On [SSO] diakafunda mu mushindu mubi bu "dibeji dia dishima dia Microsoft 365" kudi tshiamu tshia AI), kupangisha bua tshitupa tshîpi anyi kuteka liste wa IP kumpala kua njila udibu baleje bikalaku mushindu, anyi kuleja ne: udi mulelela tshiibi tshia bena mudimu.
6. Shi tshikandakanda tshidi muena mudimu muele anyi tshitupa tshia mudimu tshidibu banyanga tshidi tshibi menemene, umbusha mukanda/tshintu diakamue, imanyika konte wa muena mudimu udi wenza bibi, ne ukanga njila ku muelelu wa Cloudflare/WAF webe.
7. Tuma diandamuna dia "Executive Abuse Cure & Critical Infrastructure Escalation":
8. Diandamuna buludiludi ku tshikandakanda tshia mufundi wa malu mabi (ulama bulelela [Ticket #...] tshimanyishilu tshia tshiena bualu bua tshiamu tshiabu tshia mudimu tshidi tshilombola) NE ubikile ku telefone wa mufundi wa mikanda 24/7 bua kulomba mutangidi wa mudimu bua kuela tshimanyishilu tshia Abuse Ticket bu "Production SaaS / False Positive: Remediation Complete."
9. Weja bijadiki binayi ebi mu diandamuna diebe difunda:
   1. Dijadika dia diumusha dia lukasa: "URL udibu baleje ([exact URL]) uvua tshintu tshia muntu muisatu tshivua katshiyi tshianyishibue / tshintu tshia disumbisha tshivua tshinyanguke ne tshivua tshijimijibua bua kashidi pa [Timestamp UTC]. Mpindieu udi upingaja HTTP 404 Not Found / 410 Gone."
   2. Systemic Prevention Guardrails Implemented: "Tudi batume mikenji ya Web Application Firewall (WAF), tupangishe dituma dia mikanda ya bantu bonso idi kayiyi mijadika, ne tushintulule malu onso adi atangila tshiamu tshia mudimu bua kupangisha bualu ebu bua kuenzeka kabidi."
   3. Dimanyisha dia malu adi kaayi makane mu malu a bungenda: "Kuteka tshitupa tshia ku mutu tshia miji yourdomain.com pa clientHold mmumbushe bintu bia mudimu ne e-mail ya kumpanyi bua [Number] bakiliya/bena mudimu badi bakumbane."
   4. Dilomba dia kumbusha diakamue clientHold: "Tuasakidila bua kumbusha EPP clientHold nsombelu pa yourdomain.com diakamue. Tudi badifila bua kuandamuna ku luapolo luonso lua malu mabi mu matuku atshilualua mu mêba 2 katuyi tulomba bua kuikala ne root-domain hold."
10. Umbusha "Negative Caching (NXDOMAIN)" TTL pa DNS Resolvers ya bantu bonso padibu bamumbusha:
11. Diakamue padi mufundi wa mikanda umbusha clientHold, domaine webe mmupingane mu .com root servers, kadi Google Public DNS (8.8.8.8), Cloudflare DNS (1.1.1.1), ne OpenDNS udi mua kutungunuka ne kulama bintu bifue NXDOMAIN anyi diandamuna dia kuimana mu minite 15 too ne ku 60.
12. Diakamue, ndaku ku biamu bia mudimu bia tshianana bia ku Google Public DNS Flush Cache (developers.google.com/speed/public-dns/cache) ne Cloudflare 1.1.1.1 Purge Cache (one.one.one.one/purge-cache/), mushindu yourdomain.com (ne A, AAAA, NS, MX), ne tuaku pa Flush Cache bua bena mudimu ba pa buloba bujima bapingane mu tusunsa 60.

Tshitupa 3: Dijikija dia dikanga dia konte wa Production Cloud (AWS, Google Cloud, Microsoft Azure)¶

Padi Amazon Web Services (AWS), Google Cloud Platform (GCP), anyi Microsoft Azure bimanyika konte anyi projet wa mu matutu, mushindu wa kupingaja udi ulonda anu bikala diimanyika edi dienzeke bua Billing / Payment Failure anyi Trust & Safety / Compromised Credentials.

Difuanyikija dia tshikondo tshia mudimu wa diimanyika dia mufidi wa bintu bia mu matutu ne madidishi a dijadikulula¶

Mukenji wa 1: Kupingana kunyima kua diimanyika dia difuta dia makuta mu matutu (padi karte kabenga anyi padi tshiamu tshikanga)¶

Bua tshinyi kumpanyi idi ne makuta a bungi itu ipeta lutatu lua kuimanyika difuta dia bitadi? 1. Karte ka mfranga kadi mu tshilaminu kakafika ku tshipimu tshia makuta adibu bafila ku ngondo (tshilejilu, tshipiminu tshia dolare 25 000) bua divulangana dia autoscaling ku ndekelu kua ngondo anyi dipingaja dia Reserved Instance ku tshidimu tshionso; 2. Kalata aka kavua ka mubanji anyi VP wa Engineering mufue uvuabu bashipe karte kende kudi HR/Finance; anyi 3. Tshiamu tshia dishima tshia banke tshiakandika tshibawu tshinene tshia AWS/GCP bu "mudimu wa dishima udi kauyi ne karte."

Liste wa minite 30 ya dilongolola dia difuta dia bitadi¶

1. Buela anu bu muena konte wa ntuadijilu anyi mulombodi wa bitadi: Midimu ya IAM Developer/Admin misangu ya bungi kayena mua kubuela mu tshibuelelu tshia dipingaja dia bitadi tshikanga padibu bakanga konte to. Wenza mudimu ne AWS Root User email (anyi GCP Billing Account Administrator / Azure Account Administrator).
2. Kuena anu mua kufina pa "Teta kabidi" pa karte ka muomumue kadibu babenge kumpala kua kubikila banke to: Bikala tshiamu tshia dishima tshia banke webe tshikanga difutu dia AWS dia dolare 14 000, kuela pa "Teta kabidi" misangu isatu mu tshiamu tshia AWS nekuenze bua kubenga kabidi misangu isatu ne kukanga mushindu wa kufuta. Nansha:
3. Bueja karte ka mfranga anyi ka mfranga ka kumpanyi kashilangane bikole (kuabanya makuta mu karte abidi pikala tshiamu tshia mudimu tshia mufidi tshia makuta tshianyisha bua kufuta ndambu); NANSHA
4. Bikila nimero ya telefone idi kunyima kua karte ka kumpanyi kumpala, lomba biro bia malu a bungenda bia banke bua kumbusha tshilumbu tshia bangenda-mushinga pa Amazon Web Services / Google Cloud / Microsoft Azure ne ubandishe tshipiminu tshia dishintakaja dia bintu dimue bua mêba 24, ne anu pashishe tuaku pa Teta kabidi difuta mu tshiamu tshia mudimu tshia mu matutu.
5. Bikala tshiapu tshieba tshifuta ku diambuluisha dia Wire / ACH (Net-30 Enterprise Accounts) ne Facture mupita matuku 60+:
6. Tuma Same-Day Fedwire (ki 3-day ACH to) bua kupeta makuta onso adi mapite, wangate Wire Confirmation Receipt udi ne nomba wa IMAD/OMAD Federal Reference Number, ne ulamakaja PDF au buludiludi ku Billing & Account Support Case udi ulomba difutshila diakamue Wire-in-Transit Lift padi tshibambalu tshia makuta tshilongolola tshiamu.
7. Tangila tshilejelu tshia panyima pa dienza dia mudimu (tshiteyi tshia "VM muimane ne IP udi wenda ushintuluka"):
8. Padi AWS, GCP, anyi Azure upingaja mudimu wa konte uvuabu bakandike, mashini makuabu avua mamanyike (nangananga Azure Deallocated VMs ne GCP Compute Engine instances) KAENA mua kuenza mudimu nkayawu to, ne tshiamu tshionso tshivua katshiyi tshienza mudimu ne Elastic IP / Reserved Static IP netshilue ne **adrese wa patoke ****.
9. Tangila diakamue tshitupa tshionso tshia EC2 / Compute Engine / Azure VMs, tuadija bionso bidi bimana, enza bua Elastic Load Balancers ne RDS databases ikale Available, ne kutangila ni DNS webe A mikanda idi anu ipetangana ne IP yebe ya bantu bonso idi yenza mudimu.

Mukenji 2: Dipingaja dia bukubi mu ditutu / Tshifungu tshinyanguke / Dieyemena ne Diimanyika dia bukubi¶

Shi muenji wa bintu wenza bualu kampanda ku mpukapuka .env mukanda udi ne AWS_ACCESS_KEY_ID ne AWS_SECRET_ACCESS_KEY (anyi tshifungu tshia GCP Service Account JSON) mu tshilaminu tshia GitHub tshia bantu bonso, biamu bia tshinyangu bidi bienza mudimu nkayabi bidi bikuata tshifungu atshi mu 1,5 sekonde ne bipatula 200 ya GPU minene (p4d.24xlarge) mu bitupa bu mudi ap-east-1 anyi sa-east-1 bua kumbula makuta a tshianana anyi kuenza malu a DDoS. Mu meba makese, AWS/GCP Trust & Safety udi umona bualu budi kabuyi bujalame ne udi uteka Dikuba dia bukubi / Dikanga dia konte pa konte webe.

Mushindu kayi wa kuenza bua AWS / GCP / Azure Trust & Safety ambushe tshilumbu tshia bukubi mu mêba 4¶

Bisumbu bia bukubi bia mu matutu bidi bilonda liste wa malu adibu ne bua kulonda: ne babenga bua kupingaja konte webe too ne paudi ujadika ne: kumupingaja kakuakutuadija diakamue dibunda to. 1. Tangila tshitupa tshionso (kusangisha ne bitupa bidi ne bulema anyi bidi bisungula) ne ujimije tshitupa tshia dishipangana: - Buela mu IAM Console: Kumbusha ne kumbusha IAM Access Key munyanguke (ne bena mudimu bonso ba IAM, midimu, anyi bafidi ba lumu badi muena tshinyangu muenze bua kulama ditantamana). - Ela Hardware anyi Virtual MFA pa Root User ne bena IAM bonso. - Kangula AWS Resource Explorer / Tag Editor / EC2 Global View (tangila bitupa bionso 30+ bia buloba bujima, ki nganu us-east-1) ne Terminate bionso bidi kabiyi bianyishibue bia EC2, bisumbu bia auto Scaling, bisumbu bia EKS, ne midimu ya Lambda mienza kudi muena tshibawu. 2. Tuma luapolo lua malu a bukubi lua bitupa binayi pa tshilumbu tshia diambuluisha dia mbulamatadi: - Kangula Centre de soutien mu cloud console webe ne wandamune ku Account Security / Trust & Safety Case ne: - 1. Tshikebelu: "Muena mudimu wa IAM [Name] tshifungu AKIA... uvua mupatuke ku mpukapuka mu tshilaminu tshia kode ku [Time]." - 2. Dijimija dia mukanda wa dianyisha: "Tshifungu tshia kubuela AKIA... ne muena mudimu wa IAM mubi [Name] mbajimije bua kashidi, ne Root/IAM MFA mmuenzejibue." - 3. Dilengeja dia bintu mu bitupa bionso: "Bintu bionso bia EC2 bidi kabiyi bianyishibue mu bitupa [List Regions] mbajikije." - 4. Dilomba dia lukasa dia mudimu wa diunzulula + dishintulula dia bitadi: "Mudimu wetu wa dienza dia bintu mu [Your Region] udi wenzela [Number] bakiliya ne udi mpindieu kayi pa lutanda lua Internet. Tuasakidila bua kumbusha dikanga dia konte diakamue, ne tudi tulomba dishintulula dia bitadi/difuta dia makuta bua $[Amount] mu bitadi bia dishima bia mudimu mu tshikondo tshia dibuela dia bantu kabayi banyishibue." - (Mubelu: AWS ne GCP batu bafila musangu umua 100% wa dilekela dia mfranga bua makumi a binunu bia dolare mu bitadi bia dishima bia dipeta dia bintu bia mushinga mukole paudi ukumbaja liste wabu wa malu a dilongolola dia konte minyanguke.)

Tshitupa 4: Kuenza mudimu ne "Break-Glass" wa tshimpitshimpi mu minite 30¶

Shi tshitupa tshieba tshia kumpala (yourcompany.com) udi mukanga muinshi mua tshilaminu tshia mikanda serverHold anyi tshilumbu tshikole tshia mufundi wa mikanda tshidi mua kuangata mêba 48 too ne ku 72 bua kutshijikija, kusomba pambelu pa Enternete matuku asatu. Mudimu wonso wa malu a tekinoloji ne a e-commerce udi mua kupingaja dianyisha dia bantu badi basumba bintu ne e-mail wa bena mudimu mu minite 30 anyi 45 ku diambuluisha dia Emergency Secondary Mirror Domain (yourcompany.co, yourcompany.io, anyi getyourcompany.com).

30-Minute Emergency Secondary Domain Cutover Checklist¶

1. Funda (anyi Enza) tshitupa tshieba tshibidi kudi muena mudimu mukuabu: Kuena ne bua kufundisha tshitupa tshieba tshia panyima kudi muena mudimu umue umue uvua mupangishe tshitupa tshieba tshia kumpala to. Difundija yourcompany-app.com anyi yourcompany.co kudi mufundi udi kayi ne bumfumu (bu mudi Cloudflare Registrar, Porkbun, anyi AWS Route 53) wenza mudimu ne karte ka kumpanyi ne e-mail mujadika.
2. Bueja tshikandakanda tshieba mu Cloudflare anyi mu njila 53: Ela (anyi kopi) DNS webe A, AAAA, CNAME, ne TXT mikanda ya mu tshitupa tshieba tshia kumpala tshia DNS mu tshikandakanda tshia zone wa domaine mupiamupia nunku app.yourcompany.co ne api.yourcompany.co leja ku biamu biebe bia mudimu bia muomumue.
3. Umbusha Load Balancer / Ingress TLS Certificate (SAN Addition): Add *.yourcompany.co ne yourcompany.co bu mudi Subject Alternative Names (SANs) pa AWS ACM / Let's Encrypt / Cloudflare edge SSL certificate, ne weja dina dia host dipiadipia ku Nginx/Envoy/ALB host-header routing rules ne CORS allowlists.
4. Weja tshitupa tshibidi bu tshitupa tshijadika mu Google Workspace anyi Microsoft 365:
5. Munda mua Google Workspace Admin Console (admin.google.com -> Account -> Domains -> Manage Domains -> Add a Domain Alias) or Microsoft 365 Admin Center (Settings -> Domains -> Add Domain), weja yourcompany.co ne kuela tshijadiki TXT ne MX bifunda mu DNS wa domaine webe mupiamupia.
6. Mu minite 15, muena mudimu yonso udi upeta e-mail ku firstname@yourcompany.co munda mua kazubu kabu ka meyi kadi kakuyi dishintuluka dia kazubu ka meyi.

Tshitupa 5: Kukolesha konte yebe ya domaine ne ya cloud bua bualu ebu kabuenzeki kabidi¶

Padibu bapingana ku Enternete, enza malu atanu aa mu mêba 48:

1. Enforce Registry Lock (serverDeleteProhibited / serverUpdateProhibited / serverTransferProhibited): Bua bitupa bia mudimu bidi ne mushinga wa bungi, bandisha tshitupa tshieba ku Registry Lock (tshifila kudi Cloudflare, MarkMonitor, CSC Corporate Domains, ne bafundi banene), tshidi tshilomba dijadika dia malu a bantu ba bungi kumpala kua kushintulula nameservers anyi nsombelu wa tshitupa.
2. Kuena ne bua kuikala ne bintu bia kuenza nabi mudimu (UGC) anyi bia kumanyisha nabi pa tshitupa tshiebe tshia Apex tshia mudimu to: Ikala anu ufila bintu bidi bantu bafunda, PDF ya basumbishi, ne njila ya dilonda dia e-mail idi ifumina ku domaine wa sandbox udi mushilangane bikole (tshilejilu, yourcompany-usercontent.com pamutu pa yourcompany.com). Mu mushindu ewu, pikala muena mudimu muele mukanda mubi udi wenza bua bot wa dienza dia malu mabi, anu tshitupa tshia bintu bidi mua kuikala tshimanyishibua, ki mbua appli webe wa dienza dia bintu anyi e-mail wa kumpanyi to.
3. Teka mishindu ibidi ya difuta + ACH Backup + Cloud Billing Anomaly Alerts: Weja nansha ma karte abidi a mfranga a kudi banke ibidi mishilangane pamue ne ACH direct-debit bank account mu AWS, GCP, Azure, ne mu registre webe wa domaine, ne enza bua **AWS Cost Anomaly Detection Detection GCP /CPLert Alerts ikale mu dibeji PagerDuty/Slack pikala difutu dia ku dituku divula kupita 25 pa lukama.
4. Teka tshiamu tshia kufunda natshi mudimu ne e-mail wa Cloud Root pa tshitupa tshibidi tshia pa nkayatshi: Kutekayi nansha kakese admin@yourcompany.com bu mukanda wa dipingaja dia bintu yourcompany.com. Wenza mudimu ne kazubu ka mikanda kadibu balame ne tshiamu tshia YubiKey pa domaine wa mbulamatadi udi kayi ne bumfumu anyi pa muena mudimu udi ne bumuntu bua mudimu bua wewe kupeta misangu yonso mikanda ya dianyisha ne ya diambuluisha nansha padi domaine webe wa kumpala kayi wenza mudimu to.

Nomba ya tshimpitshimpi ya mu tshijengu ne mikenji ya bibambalu¶

Nkonko itubu bela misangu ya bungi¶

Shi AWS, Google Cloud, nansha Azure bakanga konte wetu bua dipanga dia kufuta anyi dienza dia malu mabi, bintu bietu bia mudimu ne bibombi bia S3 bidi mua kujimijibua diakamue anyi?¶

Tòo. Nansha AWS, GCP, nansha Microsoft Azure kabena bajimija malu ebe mu dituku dia kumpala dia dikanga to. Padibu bakanga konte, mashinyi ebe a patupu adi ajika ne bantu bonso badi mua kubuela mu bibombi biebe bia kulama bintu ne mu biamu bia kulama nabi bintu bidi bikanga, **kadi 100 pa lukama ya volime yebe ya EBS, ya RDS, ya bintu bia S3, ne ya bimfuanyi bidi bishala mu tshilaminu tshia mashika matuku matue ku 30** (ne mu AWS, bidi bishala mua kupingajibua mu matuku makuabu 60 panyima pa dikanga dididishi, too ne matuku 90 mu kabujima). Paudi ufuta makuta adi mapite pa dîba anyi ujikija tshilumbu tshia Trust & Safety, muaba webe wa dienza bintu udi upingana bimpe kuyi dijinga ne kuibaka tshiakabidi ku diambuluisha dia bintu bia kulama.

Bua tshinyi tshitupa tshietu tshiakalekela kujikija ne clientHold nsombelu padi dilengejibua dia domaine wetu kadiyi dikumbane bua ngondo mikuabu 8 anyi?¶

Padi domaine mufutshibue kadi kule ne dituku dia dijika dibuela mu tshimpitshimpi **`clientHold`**, kudi anu malu abidi: (1) **ICANN 15-Day WHOIS Contact Verification Failure** (muntu kampanda uvua mushintulule dina dia mufundi anyi adrese wa e-mail, anyi mushintulule domaine, ne mupangile bua kutua pa lien wa dijadika dia mushinga mukole uvuabu batumine mufundi mu matuku 15), anyi (2) **Registrar /Shishing /Spension (Malu) tshienzedi tshia njiwu tshidi tshifila lumu lua URL mubi mu domaine webe kudi tshisumbu tshia dilonda dia mikenji tshia mufundi webe). Buela mu tshibuelelu tshieba tshia bafundi diakamue: tshijadiki tshia ICANN tshidi tshijika mu minite 15 ya kufina pa tshimanyishilu tshia dipingaja, kadi tshilema tshia Abuse tshidi tshikengela kuandamuna ku mukanda wa dianyisha dia mufundi.

Bua tshinyi @ourcompany.com e-mail udi upingana kabidi pavua anu site wetu mumanyishibue bua dishima dia dishima anyi?¶

Padi mufundi wa domaine uteka EPP **`clientHold`** pa tshitupa tshieba tshia miji (`ourcompany.com`), tshilaminu tshia mikanda tshidi tshimbusha **tshitupa tshijima tshia domaine (bionso `NS` mikanda)** ya pa buloba bujima `.com` root servers. Bualu biamu bia mudimu bia pa buloba kabiena kabidi mua kukeba tshitupa tshieba to `NS` anyi `MX` mikanda, e-mail yonso udi ulua kudi `@ourcompany.com` udi upanga bua tshilema tshia dikeba dia DNS, nansha mudi e-mail webe muikale pa nkayende mu Google Workspace anyi Microsoft 365. Ke bualu kayi udi ne bua kuyukila misangu yonso ne mufundi webe ku diambuluisha dia muntu udi kayi mu tshisumbu `@gmail.com` anyi adrese wa tshitupa tshibidi mu tshikondo tshia `clientHold` dijika.

Mmunyi mutudi mua kufika kudi muntu ku AWS, GCP, anyi kudi mufundi wa domaine bituikala anu ne tshitupa tshia diambuluisha tshia tshianana tshia "Basic"?¶

Nansha pa tshitupa tshia diambuluisha dia nshindamenu tshia $0, **AWS, GCP, ne Azure badi banyishila bena mudimu ba Root badi ne konte mikanga bua kunzulula bilumbu bia diambuluisha dia "Account and Billing" bia mushinga mukole tshianana**, ne mu AWS Support Center udi mua kusungula **"Telfone"** bu mushindu webe wa kuyukila bua mumanyi wa malu a konte ne difuta dia AWS akubikile buludiludi mu minite mikese. Shi udi ulongolola dipanga dia mudimu dia lukasa, udi mua kubandisha kabidi konte webe wa AWS munda mua tshiamu tshia mudimu too ne ku **Business Support ($100/month minimum)** anyi **Enterprise On-Ramp** bua kukangula diakamue muyuki wa malu a tekiniki wa minite 15 24/7 ne dibandisha dia ku telefone.

Netuambe tshinyi pikala muena mudimu mubi anyi muenji wa mudimu wa kale muikale ne konte wa tshibuelelu tshia domaine anyi AWS Root ne mubenge kumufila?¶

Shi muena mudimu wa kale, tshibambalu tshia mudimu, anyi muena mudimu wa tshinyangu udi ukokesha konte wa mufundi anyi malu a mu ditutu ne ukanga kumpanyi, wangate bualu ebu bu tshilumbu tshia diakamue tshia dilombola dia kumpanyi ne tshia dikanga dia munda. Mufundi yonso munene wa domaine ne mufidi wa bintu bia mu matutu udi ne **Dipingaja dia konte ya kumpanyi / Dikokangana dia mufundi** mudi tshisumbu tshia mudimu tshidi tshikumbanyine mikenji mua kutuma **Mikanda ya dijadika dia kumpanyi, mukanda wa IRS EIN, difunda dia tshimanyinu tshia kumpanyi, ne mikanda ya difuta dia banke/karte ka mfranga ya kale** idi ileja ne: kumpanyi uvua mufute domaine anyi muena mudimu wa mu ditu bua kupingaja bukokeshi ku ditutu muena mudimu wa kumpanyi muanyishibue. Tangila bulombodi buetu pa [bilumbu bia buobumue, dijimija dia banke dia muena mudimu wa tshinyangu, ne dikanga dia kumpanyi](partnership-dispute-rogue-cofounder-bank-drain-and-corporate-lockout.md).

DNS udi wangata matuku bungi munyi bua kupingana pa buloba bujima kunyima kua mufundi mumane kumbusha clientHold?¶

Padi mufundi wa mikanda ufila dîyi dia EPP dia kumbusha `clientHold`, tshilaminu tshia mikanda tshia ku mutu (bu mudi Verisign bua `.com`) udi ushintulula bintu bia mu tshitupa tshia miji mu minite **3 too ne ku 15**. Bantu bavule badi benza mudimu ne internet badi mua kufika kabidi ku kazubu kebe mu minite 15 to ne ku 30, ne udi mua kufika ku **muinshi mua minite 2** bua bantu ba bungi badi balua pa buloba bujima pa kumbusha ku bianza tshitupa tshiebe tshia negative-cache mu formilere ya internet ya bantu bonso bua **Google Public DNS (`8.8.8.8`)** ne **Cloudflare DNS (`1.1.1.1`)**.

Malu adi apetangana¶

• Mpangiko ya kutungunuka ne mudimu ne dilongolola dia malu kunyima kua bipupu
• Mashinyi a bungenda ne dishipa dia tshiamu tshia mudimu
• Dikokangana dia buobumue, dijimija dia banke dia muena mudimu wa tshinyangu, ne dikanga dia kumpanyi
• Dijika dia muaba wa dipanyishila bintu (POS), dipanga dia internet, ne dienza dia karte ka mfranga kadiyi ku Enternete

Miaba ne buludiki bua mbulamatadi¶

• Internet Corporation for Assigned Names and Numbers (ICANN): 2013 Registrar Accreditation Agreement (RAA) Whois Accuracy Programme Specification (15-Day Verification Mandate), Extensible Provisioning Protocol (EPP) Status Codes (clientHold, serverHold, redemptionPeriod), ne mikenji ya dipingaja dia difunda dia matuku (ERRP).
• Amazon Web Services (AWS) Official Documentation: Account Suspension, Instatement, and Post-Closure Data Retention Lifecycle (30-Day Suspension / 60-Day Post-Closure Window) ne AWS Compromised IAM Credential Remediation Protocol.
• Google Cloud Platform (GCP) ne Microsoft Azure Official Documentation: Cloud Billing Delinquency Recovery, Project Trust & Safety Appeal Workflows, and Deallocated Azure Subscription Reactivation Procedures.
• Tshibambalu tshia malu a bukubi ne bintu bia mudimu (CISA, États-Unis) ne tshibambalu tshia malu a bukubi bua malu a ordinatere (NCSC, Royaume-Uni): Tshibambalu tshia malu a bukubi tshia mu matutu, dikumbaja dia MFA wa konte wa muji, ne mishindu mimpe ya kukanga tshilaminu tshia mikanda.
• Tshilongelu tshia ditunga tshia mikenji ne bia mudimu (NIST, États-Unis): NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide) ne NIST SP 800-53 (DNS Integrity and Cloud Access Control Standards).