Resolved IP validation in AWS Network Firewall

A standard domain rule matches on the host name that a client asserts—the TLS Server Name Indication (SNI) or the HTTP Host header. Resolved IP validation adds a check on the provenance of the destination IP address: whether your VPC's Amazon Route 53 Resolver returned this IP address when it resolved the domain. This closes the gap where a client sets Host: allowed.example.com but connects to an unrelated IP address.

Because the check is based on the destination IP address rather than on an application-layer header, it also extends domain-based rules to traffic that carries no domain name at all. This includes protocols other than HTTP and HTTPS, which standard domain rules can't inspect.

Resolved IP validation works at two levels. You can enable the policy level on its own, or add rule-level matching for specific domains on top of it:

• Policy level – Resolved IP validation, a firewall policy setting. It verifies that your VPC's Amazon Route 53 Resolver resolved the connection's destination IP address for a domain (any domain). It then applies an enforcement action to connections that fail the check. You can use this level on its own. See Configuring resolved IP validation on the firewall policy.

• Rule level – Matching on specific domains. This level requires the policy-level setting. You can match specific domains either with the AWS_ROUTE_53_RESOLVED_DOMAIN domain list target type or with the aws_route_53_resolved_domain Suricata rule keyword.

  This guide calls these resolved-domain rules. It calls the policy-level setting resolved IP validation. See Matching specific domains with resolved-domain rules.