# Amazon Route53 Resolver Construct Library
<!--BEGIN STABILITY BANNER-->---
> AWS CDK v1 has reached End-of-Support on 2023-06-01.
> This package is no longer being updated, and users should migrate to AWS CDK v2.
>
> For more information on how to migrate, see the [*Migrating to AWS CDK v2* guide](https://docs.aws.amazon.com/cdk/v2/guide/migrating-v2.html).
---
<!--END STABILITY BANNER-->
## DNS Firewall
With Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your
virtual private connections (VPCs). To do this, you create reusable collections of filtering rules
in DNS Firewall rule groups and associate the rule groups to your VPC.
DNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route
through Resolver for domain name resolution. A primary use of DNS Firewall protections is to help
prevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises
an application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain
that they control. With DNS Firewall, you can monitor and control the domains that your applications
can query. You can deny access to the domains that you know to be bad and allow all other queries
to pass through. Alternately, you can deny access to all domains except for the ones that you
explicitly trust.
### Domain lists
Domain lists can be created using a list of strings, a text file stored in Amazon S3 or a local
text file:
```python
block_list = route53resolver.FirewallDomainList(self, "BlockList",
domains=route53resolver.FirewallDomains.from_list(["bad-domain.com", "bot-domain.net"])
)
s3_list = route53resolver.FirewallDomainList(self, "S3List",
domains=route53resolver.FirewallDomains.from_s3_url("s3://bucket/prefix/object")
)
asset_list = route53resolver.FirewallDomainList(self, "AssetList",
domains=route53resolver.FirewallDomains.from_asset("/path/to/domains.txt")
)
```
The file must be a text file and must contain a single domain per line.
Use `FirewallDomainList.fromFirewallDomainListId()` to import an existing or [AWS managed domain list](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-managed-domain-lists.html):
```python
# AWSManagedDomainsMalwareDomainList in us-east-1
malware_list = route53resolver.FirewallDomainList.from_firewall_domain_list_id(self, "Malware", "rslvr-fdl-2c46f2ecbfec4dcc")
```
### Rule group
Create a rule group:
```python
# my_block_list: route53resolver.FirewallDomainList
route53resolver.FirewallRuleGroup(self, "RuleGroup",
rules=[route53resolver.FirewallRule(
priority=10,
firewall_domain_list=my_block_list,
# block and reply with NODATA
action=route53resolver.FirewallRuleAction.block()
)
]
)
```
Rules can be added at construction time or using `addRule()`:
```python
# my_block_list: route53resolver.FirewallDomainList
# rule_group: route53resolver.FirewallRuleGroup
rule_group.add_rule(
priority=10,
firewall_domain_list=my_block_list,
# block and reply with NXDOMAIN
action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain())
)
rule_group.add_rule(
priority=20,
firewall_domain_list=my_block_list,
# block and override DNS response with a custom domain
action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override("amazon.com"))
)
```
Use `associate()` to associate a rule group with a VPC:
```python
import aws_cdk.aws_ec2 as ec2
# rule_group: route53resolver.FirewallRuleGroup
# my_vpc: ec2.Vpc
rule_group.associate("Association",
priority=101,
vpc=my_vpc
)
```
Raw data
{
"_id": null,
"home_page": "https://github.com/aws/aws-cdk",
"name": "aws-cdk.aws-route53resolver",
"maintainer": "",
"docs_url": null,
"requires_python": "~=3.7",
"maintainer_email": "",
"keywords": "",
"author": "Amazon Web Services",
"author_email": "",
"download_url": "https://files.pythonhosted.org/packages/1d/7b/a4e538e25eb274e4698f3739d5d475776f27fc503c677080b44327ad3b0e/aws-cdk.aws-route53resolver-1.204.0.tar.gz",
"platform": null,
"description": "# Amazon Route53 Resolver Construct Library\n\n<!--BEGIN STABILITY BANNER-->---\n\n\n\n\n> AWS CDK v1 has reached End-of-Support on 2023-06-01.\n> This package is no longer being updated, and users should migrate to AWS CDK v2.\n>\n> For more information on how to migrate, see the [*Migrating to AWS CDK v2* guide](https://docs.aws.amazon.com/cdk/v2/guide/migrating-v2.html).\n\n---\n<!--END STABILITY BANNER-->\n\n## DNS Firewall\n\nWith Route 53 Resolver DNS Firewall, you can filter and regulate outbound DNS traffic for your\nvirtual private connections (VPCs). To do this, you create reusable collections of filtering rules\nin DNS Firewall rule groups and associate the rule groups to your VPC.\n\nDNS Firewall provides protection for outbound DNS requests from your VPCs. These requests route\nthrough Resolver for domain name resolution. A primary use of DNS Firewall protections is to help\nprevent DNS exfiltration of your data. DNS exfiltration can happen when a bad actor compromises\nan application instance in your VPC and then uses DNS lookup to send data out of the VPC to a domain\nthat they control. With DNS Firewall, you can monitor and control the domains that your applications\ncan query. You can deny access to the domains that you know to be bad and allow all other queries\nto pass through. Alternately, you can deny access to all domains except for the ones that you\nexplicitly trust.\n\n### Domain lists\n\nDomain lists can be created using a list of strings, a text file stored in Amazon S3 or a local\ntext file:\n\n```python\nblock_list = route53resolver.FirewallDomainList(self, \"BlockList\",\n domains=route53resolver.FirewallDomains.from_list([\"bad-domain.com\", \"bot-domain.net\"])\n)\n\ns3_list = route53resolver.FirewallDomainList(self, \"S3List\",\n domains=route53resolver.FirewallDomains.from_s3_url(\"s3://bucket/prefix/object\")\n)\n\nasset_list = route53resolver.FirewallDomainList(self, \"AssetList\",\n domains=route53resolver.FirewallDomains.from_asset(\"/path/to/domains.txt\")\n)\n```\n\nThe file must be a text file and must contain a single domain per line.\n\nUse `FirewallDomainList.fromFirewallDomainListId()` to import an existing or [AWS managed domain list](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-managed-domain-lists.html):\n\n```python\n# AWSManagedDomainsMalwareDomainList in us-east-1\nmalware_list = route53resolver.FirewallDomainList.from_firewall_domain_list_id(self, \"Malware\", \"rslvr-fdl-2c46f2ecbfec4dcc\")\n```\n\n### Rule group\n\nCreate a rule group:\n\n```python\n# my_block_list: route53resolver.FirewallDomainList\n\nroute53resolver.FirewallRuleGroup(self, \"RuleGroup\",\n rules=[route53resolver.FirewallRule(\n priority=10,\n firewall_domain_list=my_block_list,\n # block and reply with NODATA\n action=route53resolver.FirewallRuleAction.block()\n )\n ]\n)\n```\n\nRules can be added at construction time or using `addRule()`:\n\n```python\n# my_block_list: route53resolver.FirewallDomainList\n# rule_group: route53resolver.FirewallRuleGroup\n\n\nrule_group.add_rule(\n priority=10,\n firewall_domain_list=my_block_list,\n # block and reply with NXDOMAIN\n action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.nx_domain())\n)\n\nrule_group.add_rule(\n priority=20,\n firewall_domain_list=my_block_list,\n # block and override DNS response with a custom domain\n action=route53resolver.FirewallRuleAction.block(route53resolver.DnsBlockResponse.override(\"amazon.com\"))\n)\n```\n\nUse `associate()` to associate a rule group with a VPC:\n\n```python\nimport aws_cdk.aws_ec2 as ec2\n\n# rule_group: route53resolver.FirewallRuleGroup\n# my_vpc: ec2.Vpc\n\n\nrule_group.associate(\"Association\",\n priority=101,\n vpc=my_vpc\n)\n```\n",
"bugtrack_url": null,
"license": "Apache-2.0",
"summary": "The CDK Construct Library for AWS::Route53Resolver",
"version": "1.204.0",
"project_urls": {
"Homepage": "https://github.com/aws/aws-cdk",
"Source": "https://github.com/aws/aws-cdk.git"
},
"split_keywords": [],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "8510ee026cb7f10b60c3a53e7bc648cc60d6360250556aadc86d1a6de72c955c",
"md5": "03094c19e9d2ce711d41a9efa9f8877c",
"sha256": "7bcc1bf360408bc1745e0f1028557b1d4daf63f849ee1152ed3bd728404c3d1d"
},
"downloads": -1,
"filename": "aws_cdk.aws_route53resolver-1.204.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "03094c19e9d2ce711d41a9efa9f8877c",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": "~=3.7",
"size": 155248,
"upload_time": "2023-06-19T21:00:52",
"upload_time_iso_8601": "2023-06-19T21:00:52.000497Z",
"url": "https://files.pythonhosted.org/packages/85/10/ee026cb7f10b60c3a53e7bc648cc60d6360250556aadc86d1a6de72c955c/aws_cdk.aws_route53resolver-1.204.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "1d7ba4e538e25eb274e4698f3739d5d475776f27fc503c677080b44327ad3b0e",
"md5": "5683b01791507a0ac7a18ab9c4927c31",
"sha256": "1c7873c5f5214095133d3865ff7322cc67f2abcb1bb3eb240b970c7fa5633090"
},
"downloads": -1,
"filename": "aws-cdk.aws-route53resolver-1.204.0.tar.gz",
"has_sig": false,
"md5_digest": "5683b01791507a0ac7a18ab9c4927c31",
"packagetype": "sdist",
"python_version": "source",
"requires_python": "~=3.7",
"size": 156175,
"upload_time": "2023-06-19T21:07:04",
"upload_time_iso_8601": "2023-06-19T21:07:04.959120Z",
"url": "https://files.pythonhosted.org/packages/1d/7b/a4e538e25eb274e4698f3739d5d475776f27fc503c677080b44327ad3b0e/aws-cdk.aws-route53resolver-1.204.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2023-06-19 21:07:04",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "aws",
"github_project": "aws-cdk",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "aws-cdk.aws-route53resolver"
}
JSON
