Amazon Route53 Resolver Construct Library

Version 2.274.0-alpha.0

Separate package

@aws-cdk/aws-route53resolver-alpha is not part of aws-cdk-lib — install it separately:

npm install @aws-cdk/aws-route53resolver-alpha
pip install aws-cdk.aws-route53resolver-alpha

This module is experimental (alpha): its API may change in any release, without a major version bump.

cdk-constructs: Experimental

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

DNS Firewall

With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your virtual private connections (VPCs). To do this, you create reusable collections of filtering rules in DNS Firewall rule groups and associate the rule groups to your VPC.

DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain that they control. With DNS Firewall, you can monitor and control the domains that your applications can query. You can deny access to the domains that you know to be bad and allow all other queries to pass through. Alternately, you can deny access to all domains except for the ones that you explicitly trust.

Domain lists

Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local text file:

const blockList = new route53resolver.FirewallDomainList(this, 'BlockList', {
  domains: route53resolver.FirewallDomains.fromList(['bad-domain.com', 'bot-domain.net']),
});

const s3List = new route53resolver.FirewallDomainList(this, 'S3List', {
  domains: route53resolver.FirewallDomains.fromS3Url('s3://bucket/prefix/object'),
});

const assetList = new route53resolver.FirewallDomainList(this, 'AssetList', {
  domains: route53resolver.FirewallDomains.fromAsset('/path/to/domains.txt'),
});

python

block_list = route53resolver.FirewallDomainList(self, "BlockList",
    domains=route53resolver.FirewallDomains.from_list(["bad-domain.com", "bot-domain.net"])
)

s3_list = route53resolver.FirewallDomainList(self, "S3List",
    domains=route53resolver.FirewallDomains.from_s3_url("s3://bucket/prefix/object")
)

asset_list = route53resolver.FirewallDomainList(self, "AssetList",
    domains=route53resolver.FirewallDomains.from_asset("/path/to/domains.txt")
)

java

FirewallDomainList blockList = FirewallDomainList.Builder.create(this, "BlockList")
        .domains(FirewallDomains.fromList(List.of("bad-domain.com", "bot-domain.net")))
        .build();

FirewallDomainList s3List = FirewallDomainList.Builder.create(this, "S3List")
        .domains(FirewallDomains.fromS3Url("s3://bucket/prefix/object"))
        .build();

FirewallDomainList assetList = FirewallDomainList.Builder.create(this, "AssetList")
        .domains(FirewallDomains.fromAsset("/path/to/domains.txt"))
        .build();

csharp

var blockList = new FirewallDomainList(this, "BlockList", new FirewallDomainListProps {
    Domains = FirewallDomains.FromList(new [] { "bad-domain.com", "bot-domain.net" })
});

var s3List = new FirewallDomainList(this, "S3List", new FirewallDomainListProps {
    Domains = FirewallDomains.FromS3Url("s3://bucket/prefix/object")
});

var assetList = new FirewallDomainList(this, "AssetList", new FirewallDomainListProps {
    Domains = FirewallDomains.FromAsset("/path/to/domains.txt")
});

blockList := route53resolver.NewFirewallDomainList(this, jsii.String("BlockList"), &FirewallDomainListProps{
	Domains: route53resolver.FirewallDomains_FromList([]*string{
		jsii.String("bad-domain.com"),
		jsii.String("bot-domain.net"),
	}),
})

s3List := route53resolver.NewFirewallDomainList(this, jsii.String("S3List"), &FirewallDomainListProps{
	Domains: route53resolver.FirewallDomains_FromS3Url(jsii.String("s3://bucket/prefix/object")),
})

assetList := route53resolver.NewFirewallDomainList(this, jsii.String("AssetList"), &FirewallDomainListProps{
	Domains: route53resolver.FirewallDomains_FromAsset(jsii.String("/path/to/domains.txt")),
})

The file must be a text file and must contain a single domain per line.

Use FirewallDomainList.fromFirewallDomainListId() to import an existing or AWS managed domain list:

// AWSManagedDomainsMalwareDomainList in us-east-1
const malwareList = route53resolver.FirewallDomainList.fromFirewallDomainListId(
  this,
  'Malware',
  'rslvr-fdl-2c46f2ecbfec4dcc',
);

python

# AWSManagedDomainsMalwareDomainList in us-east-1
malware_list = route53resolver.FirewallDomainList.from_firewall_domain_list_id(self, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc")

java

// AWSManagedDomainsMalwareDomainList in us-east-1
IFirewallDomainList malwareList = FirewallDomainList.fromFirewallDomainListId(this, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc");

csharp

// AWSManagedDomainsMalwareDomainList in us-east-1
var malwareList = FirewallDomainList.FromFirewallDomainListId(this, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc");

// AWSManagedDomainsMalwareDomainList in us-east-1
malwareList := route53resolver.FirewallDomainList_FromFirewallDomainListId(this, jsii.String("Malware"), jsii.String("rslvr-fdl-2c46f2ecbfec4dcc"))

Rule group

Create a rule group:

declare const myBlockList: route53resolver.FirewallDomainList;
new route53resolver.FirewallRuleGroup(this, 'RuleGroup', {
  rules: [
    {
      priority: 10,
      firewallDomainList: myBlockList,
      // block and reply with NODATA
      action: route53resolver.FirewallRuleAction.block(),
    },
  ],
});

python

# my_block_list: route53resolver.FirewallDomainList

route53resolver.FirewallRuleGroup(self, "RuleGroup",
    rules=[route53resolver.FirewallRule(
        priority=10,
        firewall_domain_list=my_block_list,
        # block and reply with NODATA
        action=route53resolver.FirewallRuleAction.block()
    )
    ]
)

java

FirewallDomainList myBlockList;

FirewallRuleGroup.Builder.create(this, "RuleGroup")
        .rules(List.of(FirewallRule.builder()
                .priority(10)
                .firewallDomainList(myBlockList)
                // block and reply with NODATA
                .action(FirewallRuleAction.block())
                .build()))
        .build();

csharp

FirewallDomainList myBlockList;

new FirewallRuleGroup(this, "RuleGroup", new FirewallRuleGroupProps {
    Rules = new [] { new FirewallRule {
        Priority = 10,
        FirewallDomainList = myBlockList,
        // block and reply with NODATA
        Action = FirewallRuleAction.Block()
    } }
});

var myBlockList FirewallDomainList

route53resolver.NewFirewallRuleGroup(this, jsii.String("RuleGroup"), &FirewallRuleGroupProps{
	Rules: []FirewallRule{
		&FirewallRule{
			Priority: jsii.Number(10),
			FirewallDomainList: myBlockList,
			// block and reply with NODATA
			Action: route53resolver.FirewallRuleAction_Block(),
		},
	},
})

Rules can be added at construction time or using addRule():

declare const myBlockList: route53resolver.FirewallDomainList;
declare const ruleGroup: route53resolver.FirewallRuleGroup;

ruleGroup.addRule({
  priority: 10,
  firewallDomainList: myBlockList,
  // block and reply with NXDOMAIN
  action: route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nxDomain()),
});

ruleGroup.addRule({
  priority: 20,
  firewallDomainList: myBlockList,
  // block and override DNS response with a custom domain
  action: route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override('amazon.com')),
});

python

# my_block_list: route53resolver.FirewallDomainList
# rule_group: route53resolver.FirewallRuleGroup


rule_group.add_rule(
    priority=10,
    firewall_domain_list=my_block_list,
    # block and reply with NXDOMAIN
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain())
)

rule_group.add_rule(
    priority=20,
    firewall_domain_list=my_block_list,
    # block and override DNS response with a custom domain
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override("amazon.com"))
)

java

FirewallDomainList myBlockList;
FirewallRuleGroup ruleGroup;


ruleGroup.addRule(FirewallRule.builder()
        .priority(10)
        .firewallDomainList(myBlockList)
        // block and reply with NXDOMAIN
        .action(FirewallRuleAction.block(DnsBlockResponse.nxDomain()))
        .build());

ruleGroup.addRule(FirewallRule.builder()
        .priority(20)
        .firewallDomainList(myBlockList)
        // block and override DNS response with a custom domain
        .action(FirewallRuleAction.block(DnsBlockResponse.override("amazon.com")))
        .build());

csharp

FirewallDomainList myBlockList;
FirewallRuleGroup ruleGroup;


ruleGroup.AddRule(new FirewallRule {
    Priority = 10,
    FirewallDomainList = myBlockList,
    // block and reply with NXDOMAIN
    Action = FirewallRuleAction.Block(DnsBlockResponse.NxDomain())
});

ruleGroup.AddRule(new FirewallRule {
    Priority = 20,
    FirewallDomainList = myBlockList,
    // block and override DNS response with a custom domain
    Action = FirewallRuleAction.Block(DnsBlockResponse.Override("amazon.com"))
});

var myBlockList FirewallDomainList
var ruleGroup FirewallRuleGroup


ruleGroup.AddRule(&FirewallRule{
	Priority: jsii.Number(10),
	FirewallDomainList: myBlockList,
	// block and reply with NXDOMAIN
	Action: route53resolver.FirewallRuleAction_Block(route53resolver.DnsBlockResponse_NxDomain()),
})

ruleGroup.AddRule(&FirewallRule{
	Priority: jsii.Number(20),
	FirewallDomainList: myBlockList,
	// block and override DNS response with a custom domain
	Action: route53resolver.FirewallRuleAction_*Block(route53resolver.DnsBlockResponse_Override(jsii.String("amazon.com"))),
})

Use associate() to associate a rule group with a VPC:

import * as ec2 from 'aws-cdk-lib/aws-ec2';

declare const ruleGroup: route53resolver.FirewallRuleGroup;
declare const myVpc: ec2.Vpc;

ruleGroup.associate('Association', {
  priority: 101,
  vpc: myVpc,
})

python

import aws_cdk.aws_ec2 as ec2

# rule_group: route53resolver.FirewallRuleGroup
# my_vpc: ec2.Vpc


rule_group.associate("Association",
    priority=101,
    vpc=my_vpc
)

java

import software.amazon.awscdk.services.ec2.*;

FirewallRuleGroup ruleGroup;
Vpc myVpc;


ruleGroup.associate("Association", FirewallRuleGroupAssociationOptions.builder()
        .priority(101)
        .vpc(myVpc)
        .build());

csharp

using Amazon.CDK.AWS.EC2;

FirewallRuleGroup ruleGroup;
Vpc myVpc;


ruleGroup.Associate("Association", new FirewallRuleGroupAssociationOptions {
    Priority = 101,
    Vpc = myVpc
});

import ec2 "github.com/aws/aws-cdk-go/awscdk"

var ruleGroup FirewallRuleGroup
var myVpc Vpc


ruleGroup.Associate(jsii.String("Association"), &FirewallRuleGroupAssociationOptions{
	Priority: jsii.Number(101),
	Vpc: myVpc,
})

Types

Name	Kind	Summary
`FirewallDomainList`	Construct (L2)	A Firewall Domain List.
`FirewallRuleGroup`	Construct (L2)	A Firewall Rule Group.
`FirewallRuleGroupAssociation`	Construct (L2)	A Firewall Rule Group Association.
`DnsBlockResponse`	Class	The way that you want DNS Firewall to block the request.
`DomainsConfig`	Struct	Domains configuration.
`FirewallDomainListProps`	Struct	Properties for a Firewall Domain List.
`FirewallDomains`	Class	A list of domains.
`FirewallRule`	Struct	A Firewall Rule.
`FirewallRuleAction`	Class	A Firewall Rule.
`FirewallRuleGroupAssociationOptions`	Struct	Options for a Firewall Rule Group Association.
`FirewallRuleGroupAssociationProps`	Struct	Properties for a Firewall Rule Group Association.
`FirewallRuleGroupProps`	Struct	Properties for a Firewall Rule Group.
`IFirewallDomainList`	Interface	A Firewall Domain List.
`IFirewallRuleGroup`	Interface	A Firewall Rule Group.

Amazon Route53 Resolver Construct Library ​

DNS Firewall ​

Domain lists ​

Rule group ​

Types ​

Amazon Route53 Resolver Construct Library

DNS Firewall

Domain lists

Rule group

Types