Namespace Amazon.CDK.AWS.Route53Resolver
Amazon Route53 Resolver Construct Library
---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.
For more information on how to migrate, see the Migrating to AWS CDK v2 guide.
DNS Firewall
With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your virtual private connections (VPCs). To do this, you create reusable collections of filtering rules in DNS Firewall rule groups and associate the rule groups to your VPC.
DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain that they control. With DNS Firewall, you can monitor and control the domains that your applications can query. You can deny access to the domains that you know to be bad and allow all other queries to pass through. Alternately, you can deny access to all domains except for the ones that you explicitly trust.
Domain lists
Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local text file:
var blockList = new FirewallDomainList(this, "BlockList", new FirewallDomainListProps {
Domains = FirewallDomains.FromList(new [] { "bad-domain.com", "bot-domain.net" })
});
var s3List = new FirewallDomainList(this, "S3List", new FirewallDomainListProps {
Domains = FirewallDomains.FromS3Url("s3://bucket/prefix/object")
});
var assetList = new FirewallDomainList(this, "AssetList", new FirewallDomainListProps {
Domains = FirewallDomains.FromAsset("/path/to/domains.txt")
});
The file must be a text file and must contain a single domain per line.
Use FirewallDomainList.fromFirewallDomainListId()
to import an existing or AWS managed domain list:
// AWSManagedDomainsMalwareDomainList in us-east-1
var malwareList = FirewallDomainList.FromFirewallDomainListId(this, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc");
Rule group
Create a rule group:
FirewallDomainList myBlockList;
new FirewallRuleGroup(this, "RuleGroup", new FirewallRuleGroupProps {
Rules = new [] { new FirewallRule {
Priority = 10,
FirewallDomainList = myBlockList,
// block and reply with NODATA
Action = FirewallRuleAction.Block()
} }
});
Rules can be added at construction time or using addRule()
:
FirewallDomainList myBlockList;
FirewallRuleGroup ruleGroup;
ruleGroup.AddRule(new FirewallRule {
Priority = 10,
FirewallDomainList = myBlockList,
// block and reply with NXDOMAIN
Action = FirewallRuleAction.Block(DnsBlockResponse.NxDomain())
});
ruleGroup.AddRule(new FirewallRule {
Priority = 20,
FirewallDomainList = myBlockList,
// block and override DNS response with a custom domain
Action = FirewallRuleAction.Block(DnsBlockResponse.Override("amazon.com"))
});
Use associate()
to associate a rule group with a VPC:
using Amazon.CDK.AWS.EC2;
FirewallRuleGroup ruleGroup;
Vpc myVpc;
ruleGroup.Associate("Association", new FirewallRuleGroupAssociationOptions {
Priority = 101,
Vpc = myVpc
});
Classes
CfnFirewallDomainList | A CloudFormation |
CfnFirewallDomainListProps | Properties for defining a |
CfnFirewallRuleGroup | A CloudFormation |
CfnFirewallRuleGroup.FirewallRuleProperty | A single firewall rule in a rule group. |
CfnFirewallRuleGroupAssociation | A CloudFormation |
CfnFirewallRuleGroupAssociationProps | Properties for defining a |
CfnFirewallRuleGroupProps | Properties for defining a |
CfnResolverConfig | A CloudFormation |
CfnResolverConfigProps | Properties for defining a |
CfnResolverDNSSECConfig | A CloudFormation |
CfnResolverDNSSECConfigProps | Properties for defining a |
CfnResolverEndpoint | A CloudFormation |
CfnResolverEndpoint.IpAddressRequestProperty | In a CreateResolverEndpoint request, the IP address that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). |
CfnResolverEndpointProps | Properties for defining a |
CfnResolverQueryLoggingConfig | A CloudFormation |
CfnResolverQueryLoggingConfigAssociation | A CloudFormation |
CfnResolverQueryLoggingConfigAssociationProps | Properties for defining a |
CfnResolverQueryLoggingConfigProps | Properties for defining a |
CfnResolverRule | A CloudFormation |
CfnResolverRule.TargetAddressProperty | In a CreateResolverRule request, an array of the IPs that you want to forward DNS queries to. |
CfnResolverRuleAssociation | A CloudFormation |
CfnResolverRuleAssociationProps | Properties for defining a |
CfnResolverRuleProps | Properties for defining a |
DnsBlockResponse | (experimental) The way that you want DNS Firewall to block the request. |
DomainsConfig | (experimental) Domains configuration. |
FirewallDomainList | (experimental) A Firewall Domain List. |
FirewallDomainListProps | (experimental) Properties for a Firewall Domain List. |
FirewallDomains | (experimental) A list of domains. |
FirewallRule | (experimental) A Firewall Rule. |
FirewallRuleAction | (experimental) A Firewall Rule. |
FirewallRuleGroup | (experimental) A Firewall Rule Group. |
FirewallRuleGroupAssociation | (experimental) A Firewall Rule Group Association. |
FirewallRuleGroupAssociationOptions | (experimental) Options for a Firewall Rule Group Association. |
FirewallRuleGroupAssociationProps | (experimental) Properties for a Firewall Rule Group Association. |
FirewallRuleGroupProps | (experimental) Properties for a Firewall Rule Group. |
Interfaces
CfnFirewallRuleGroup.IFirewallRuleProperty | A single firewall rule in a rule group. |
CfnResolverEndpoint.IIpAddressRequestProperty | In a CreateResolverEndpoint request, the IP address that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). |
CfnResolverRule.ITargetAddressProperty | In a CreateResolverRule request, an array of the IPs that you want to forward DNS queries to. |
ICfnFirewallDomainListProps | Properties for defining a |
ICfnFirewallRuleGroupAssociationProps | Properties for defining a |
ICfnFirewallRuleGroupProps | Properties for defining a |
ICfnResolverConfigProps | Properties for defining a |
ICfnResolverDNSSECConfigProps | Properties for defining a |
ICfnResolverEndpointProps | Properties for defining a |
ICfnResolverQueryLoggingConfigAssociationProps | Properties for defining a |
ICfnResolverQueryLoggingConfigProps | Properties for defining a |
ICfnResolverRuleAssociationProps | Properties for defining a |
ICfnResolverRuleProps | Properties for defining a |
IDomainsConfig | (experimental) Domains configuration. |
IFirewallDomainList | (experimental) A Firewall Domain List. |
IFirewallDomainListProps | (experimental) Properties for a Firewall Domain List. |
IFirewallRule | (experimental) A Firewall Rule. |
IFirewallRuleGroup | (experimental) A Firewall Rule Group. |
IFirewallRuleGroupAssociationOptions | (experimental) Options for a Firewall Rule Group Association. |
IFirewallRuleGroupAssociationProps | (experimental) Properties for a Firewall Rule Group Association. |
IFirewallRuleGroupProps | (experimental) Properties for a Firewall Rule Group. |