Package: aws-cdk.aws-route53resolver-alpha
Amazon Route53 Resolver Construct Library---The APIs of higher level constructs in this module are experimental and under active development.
They are subject to non-backward compatible changes or removal in any future version. These are
not subject to theSemantic Versioningmodel and breaking changes will be
announced in the release notes. This means that while you may use them, you may need to update
your source code when upgrading to a newer version of this package.DNS FirewallWith Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your
virtual private connections (VPCs). To do this, you create reusable collections of filtering rules
in DNS Firewall rule groups and associate the rule groups to your VPC.DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route
through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help
prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises
an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain
that they control. With DNS Firewall, you can monitor and control the domains that your applications
can query. You can deny access to the domains that you know to be bad and allow all other queries
to pass through. Alternately, you can deny access to all domains except for the ones that you
explicitly trust.Domain listsDomain lists can be created using a list of strings, a text file stored in Amazon S3 or a local
text file:block_list=route53resolver.FirewallDomainList(self,"BlockList",domains=route53resolver.FirewallDomains.from_list(["bad-domain.com","bot-domain.net"]))s3_list=route53resolver.FirewallDomainList(self,"S3List",domains=route53resolver.FirewallDomains.from_s3_url("s3://bucket/prefix/object"))asset_list=route53resolver.FirewallDomainList(self,"AssetList",domains=route53resolver.FirewallDomains.from_asset("/path/to/domains.txt"))The file must be a text file and must contain a single domain per line.UseFirewallDomainList.fromFirewallDomainListId()to import an existing orAWS managed domain list:# AWSManagedDomainsMalwareDomainList in us-east-1malware_list=route53resolver.FirewallDomainList.from_firewall_domain_list_id(self,"Malware","rslvr-fdl-2c46f2ecbfec4dcc")Rule groupCreate a rule group:# my_block_list: route53resolver.FirewallDomainListroute53resolver.FirewallRuleGroup(self,"RuleGroup",rules=[route53resolver.FirewallRule(priority=10,firewall_domain_list=my_block_list,# block and reply with NODATAaction=route53resolver.FirewallRuleAction.block())])Rules can be added at construction time or usingaddRule():# my_block_list: route53resolver.FirewallDomainList# rule_group: route53resolver.FirewallRuleGrouprule_group.add_rule(priority=10,firewall_domain_list=my_block_list,# block and reply with NXDOMAINaction=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain()))rule_group.add_rule(priority=20,firewall_domain_list=my_block_list,# block and override DNS response with a custom domainaction=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override("amazon.com")))Useassociate()to associate a rule group with a VPC:importaws_cdk.aws_ec2asec2# rule_group: route53resolver.FirewallRuleGroup# my_vpc: ec2.Vpcrule_group.associate("Association",priority=101,vpc=my_vpc)