Amazon Route53 Resolver Construct Library

---

End-of-Support

AWS CDK v1 has reached End-of-Support on 2023-06-01. This package is no longer being updated, and users should migrate to AWS CDK v2.

For more information on how to migrate, see the Migrating to AWS CDK v2 guide.

DNS Firewall

With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your virtual private connections (VPCs). To do this, you create reusable collections of filtering rules in DNS Firewall rule groups and associate the rule groups to your VPC.

DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain that they control. With DNS Firewall, you can monitor and control the domains that your applications can query. You can deny access to the domains that you know to be bad and allow all other queries to pass through. Alternately, you can deny access to all domains except for the ones that you explicitly trust.

Domain lists

Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local text file:

block_list = route53resolver.FirewallDomainList(self, "BlockList",
    domains=route53resolver.FirewallDomains.from_list(["bad-domain.com", "bot-domain.net"])
)

s3_list = route53resolver.FirewallDomainList(self, "S3List",
    domains=route53resolver.FirewallDomains.from_s3_url("s3://bucket/prefix/object")
)

asset_list = route53resolver.FirewallDomainList(self, "AssetList",
    domains=route53resolver.FirewallDomains.from_asset("/path/to/domains.txt")
)

The file must be a text file and must contain a single domain per line.

Use FirewallDomainList.fromFirewallDomainListId() to import an existing or AWS managed domain list:

# AWSManagedDomainsMalwareDomainList in us-east-1
malware_list = route53resolver.FirewallDomainList.from_firewall_domain_list_id(self, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc")

Rule group

Create a rule group:

# my_block_list: route53resolver.FirewallDomainList

route53resolver.FirewallRuleGroup(self, "RuleGroup",
    rules=[route53resolver.FirewallRule(
        priority=10,
        firewall_domain_list=my_block_list,
        # block and reply with NODATA
        action=route53resolver.FirewallRuleAction.block()
    )
    ]
)

Rules can be added at construction time or using addRule():

# my_block_list: route53resolver.FirewallDomainList
# rule_group: route53resolver.FirewallRuleGroup


rule_group.add_rule(
    priority=10,
    firewall_domain_list=my_block_list,
    # block and reply with NXDOMAIN
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain())
)

rule_group.add_rule(
    priority=20,
    firewall_domain_list=my_block_list,
    # block and override DNS response with a custom domain
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override("amazon.com"))
)

Use associate() to associate a rule group with a VPC:

import aws_cdk.aws_ec2 as ec2

# rule_group: route53resolver.FirewallRuleGroup
# my_vpc: ec2.Vpc


rule_group.associate("Association",
    priority=101,
    vpc=my_vpc
)

Release files for aws-cdk.aws-route53resolver 1.204.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for aws-cdk.aws-route53resolver 1.204.0
File	Size	Uploaded
aws-cdk.aws-route53resolver-1.204.0.tar.gz	156.2 kB	Jun 19, 2023	Details

Built distribution (wheel)

Table of built distributions (wheels) for aws-cdk.aws-route53resolver 1.204.0
File	Interpreter	ABI	Platform	Reset
aws_cdk.aws_route53resolver-1.204.0-py3-none-any.whl 155.2 kB Jun 19, 2023	Python 3	none	any	Details

Total release size: 311.4 kB

Release files / aws-cdk.aws-route53resolver-1.204.0.tar.gz

Download URL	aws-cdk.aws-route53resolver-1.204.0.tar.gz
Size	156.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`1c7873c5f5214095133d3865ff7322cc67f2abcb1bb3eb240b970c7fa5633090`
BLAKE2b-256 checksum How to use checksums	`1d7ba4e538e25eb274e4698f3739d5d475776f27fc503c677080b44327ad3b0e`
Upload date	Jun 19, 2023
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.2 CPython/3.11.2`

Release files / aws_cdk.aws_route53resolver-1.204.0-py3-none-any.whl

Download URL	aws_cdk.aws_route53resolver-1.204.0-py3-none-any.whl
Size	155.2 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`7bcc1bf360408bc1745e0f1028557b1d4daf63f849ee1152ed3bd728404c3d1d`
BLAKE2b-256 checksum How to use checksums	`8510ee026cb7f10b60c3a53e7bc648cc60d6360250556aadc86d1a6de72c955c`
Upload date	Jun 19, 2023
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.2 CPython/3.11.2`