Package software.amazon.awscdk.services.route53resolver.alpha
Amazon Route53 Resolver Construct Library
---
The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.
DNS Firewall
With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your virtual private connections (VPCs). To do this, you create reusable collections of filtering rules in DNS Firewall rule groups and associate the rule groups to your VPC.
DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain that they control. With DNS Firewall, you can monitor and control the domains that your applications can query. You can deny access to the domains that you know to be bad and allow all other queries to pass through. Alternately, you can deny access to all domains except for the ones that you explicitly trust.
Domain lists
Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local text file:
FirewallDomainList blockList = FirewallDomainList.Builder.create(this, "BlockList") .domains(FirewallDomains.fromList(List.of("bad-domain.com", "bot-domain.net"))) .build(); FirewallDomainList s3List = FirewallDomainList.Builder.create(this, "S3List") .domains(FirewallDomains.fromS3Url("s3://bucket/prefix/object")) .build(); FirewallDomainList assetList = FirewallDomainList.Builder.create(this, "AssetList") .domains(FirewallDomains.fromAsset("/path/to/domains.txt")) .build();
The file must be a text file and must contain a single domain per line.
Use FirewallDomainList.fromFirewallDomainListId()
to import an existing or AWS managed domain list:
// AWSManagedDomainsMalwareDomainList in us-east-1 IFirewallDomainList malwareList = FirewallDomainList.fromFirewallDomainListId(this, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc");
Rule group
Create a rule group:
FirewallDomainList myBlockList; FirewallRuleGroup.Builder.create(this, "RuleGroup") .rules(List.of(FirewallRule.builder() .priority(10) .firewallDomainList(myBlockList) // block and reply with NODATA .action(FirewallRuleAction.block()) .build())) .build();
Rules can be added at construction time or using addRule()
:
FirewallDomainList myBlockList; FirewallRuleGroup ruleGroup; ruleGroup.addRule(FirewallRule.builder() .priority(10) .firewallDomainList(myBlockList) // block and reply with NXDOMAIN .action(FirewallRuleAction.block(DnsBlockResponse.nxDomain())) .build()); ruleGroup.addRule(FirewallRule.builder() .priority(20) .firewallDomainList(myBlockList) // block and override DNS response with a custom domain .action(FirewallRuleAction.block(DnsBlockResponse.override("amazon.com"))) .build());
Use associate()
to associate a rule group with a VPC:
import software.amazon.awscdk.services.ec2.*; FirewallRuleGroup ruleGroup; Vpc myVpc; ruleGroup.associate("Association", FirewallRuleGroupAssociationOptions.builder() .priority(101) .vpc(myVpc) .build());
-
ClassDescription(experimental) The way that you want DNS Firewall to block the request.(experimental) Domains configuration.A builder for
DomainsConfig
An implementation forDomainsConfig
(experimental) A Firewall Domain List.(experimental) A fluent builder forFirewallDomainList
.(experimental) Properties for a Firewall Domain List.A builder forFirewallDomainListProps
An implementation forFirewallDomainListProps
(experimental) A list of domains.(experimental) A Firewall Rule.A builder forFirewallRule
An implementation forFirewallRule
(experimental) A Firewall Rule.(experimental) A Firewall Rule Group.(experimental) A fluent builder forFirewallRuleGroup
.(experimental) A Firewall Rule Group Association.(experimental) A fluent builder forFirewallRuleGroupAssociation
.(experimental) Options for a Firewall Rule Group Association.A builder forFirewallRuleGroupAssociationOptions
An implementation forFirewallRuleGroupAssociationOptions
(experimental) Properties for a Firewall Rule Group Association.A builder forFirewallRuleGroupAssociationProps
An implementation forFirewallRuleGroupAssociationProps
(experimental) Properties for a Firewall Rule Group.A builder forFirewallRuleGroupProps
An implementation forFirewallRuleGroupProps
(experimental) A Firewall Domain List.Internal default implementation forIFirewallDomainList
.A proxy class which represents a concrete javascript instance of this type.(experimental) A Firewall Rule Group.Internal default implementation forIFirewallRuleGroup
.A proxy class which represents a concrete javascript instance of this type.