Amazon Route53 Resolver Construct Library

---

cdk-constructs: Experimental

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

DNS Firewall

With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your virtual private connections (VPCs). To do this, you create reusable collections of filtering rules in DNS Firewall rule groups and associate the rule groups to your VPC.

DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain that they control. With DNS Firewall, you can monitor and control the domains that your applications can query. You can deny access to the domains that you know to be bad and allow all other queries to pass through. Alternately, you can deny access to all domains except for the ones that you explicitly trust.

Domain lists

Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local text file:

block_list = route53resolver.FirewallDomainList(self, "BlockList",
    domains=route53resolver.FirewallDomains.from_list(["bad-domain.com", "bot-domain.net"])
)

s3_list = route53resolver.FirewallDomainList(self, "S3List",
    domains=route53resolver.FirewallDomains.from_s3_url("s3://bucket/prefix/object")
)

asset_list = route53resolver.FirewallDomainList(self, "AssetList",
    domains=route53resolver.FirewallDomains.from_asset("/path/to/domains.txt")
)

The file must be a text file and must contain a single domain per line.

Use FirewallDomainList.fromFirewallDomainListId() to import an existing or AWS managed domain list:

# AWSManagedDomainsMalwareDomainList in us-east-1
malware_list = route53resolver.FirewallDomainList.from_firewall_domain_list_id(self, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc")

Rule group

Create a rule group:

# my_block_list: route53resolver.FirewallDomainList

route53resolver.FirewallRuleGroup(self, "RuleGroup",
    rules=[route53resolver.FirewallRule(
        priority=10,
        firewall_domain_list=my_block_list,
        # block and reply with NODATA
        action=route53resolver.FirewallRuleAction.block()
    )
    ]
)

Rules can be added at construction time or using addRule():

# my_block_list: route53resolver.FirewallDomainList
# rule_group: route53resolver.FirewallRuleGroup


rule_group.add_rule(
    priority=10,
    firewall_domain_list=my_block_list,
    # block and reply with NXDOMAIN
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain())
)

rule_group.add_rule(
    priority=20,
    firewall_domain_list=my_block_list,
    # block and override DNS response with a custom domain
    action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override("amazon.com"))
)

Use associate() to associate a rule group with a VPC:

import aws_cdk.aws_ec2 as ec2

# rule_group: route53resolver.FirewallRuleGroup
# my_vpc: ec2.Vpc


rule_group.associate("Association",
    priority=101,
    vpc=my_vpc
)

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

aws_cdk_aws_route53resolver_alpha-2.268.0a0.tar.gz (78.3 kB view details)

Uploaded Sep 2, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

aws_cdk_aws_route53resolver_alpha-2.268.0a0-py3-none-any.whl (76.9 kB view details)

Uploaded Sep 2, 2026 Python 3

File details

Details for the file aws_cdk_aws_route53resolver_alpha-2.268.0a0.tar.gz.

File metadata

Download URL: aws_cdk_aws_route53resolver_alpha-2.268.0a0.tar.gz
Upload date: Sep 2, 2026
Size: 78.3 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.11.15

File hashes

Hashes for aws_cdk_aws_route53resolver_alpha-2.268.0a0.tar.gz
Algorithm	Hash digest
SHA256	`8821418c5231ee7b84f16f3b5548e10ce5eb989fc2778a63e43fb2f6fd1ea9c8`
MD5	`f1e9e7c6a2199af032aecb4b9333e26f`
BLAKE2b-256	`b8dbc8cb61710fc8a437d3a2dea3fd232bb8f41acfdc4078839fda675ee48ca9`

See more details on using hashes here.

File details

Details for the file aws_cdk_aws_route53resolver_alpha-2.268.0a0-py3-none-any.whl.

File metadata

Download URL: aws_cdk_aws_route53resolver_alpha-2.268.0a0-py3-none-any.whl
Upload date: Sep 2, 2026
Size: 76.9 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/7.0.0 CPython/3.11.15

File hashes

Hashes for aws_cdk_aws_route53resolver_alpha-2.268.0a0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`5889810c1171f0e9b91991f8153dda04e7cbec8edfbce0dfe95c5f38c759832e`
MD5	`0c1c26ca8116bfa09d6d8c9735a5606e`
BLAKE2b-256	`9c5db8c7e9fc6812336ee49333bac88e8ae94414f28929c19f2e1edebfedc189`