Amazon Route 53 Resolver DNS Firewall

aws Firewallaws-route53-dns-firewall

Domain-name filtering for outbound DNS queries leaving a VPC through the Route 53 Resolver.

Provider: aws
Kind: Firewall
Category: Security
Official docs: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall.html

Properties · 5 set by this component

property	type	values	required	kind default	this component
awsManagedDomainLists · component property	boolean	—	no	false	inherited
blockResponse · component property	enum	nodata \| nxdomain \| override	no	—	inherited
defaultAction	enum	allow \| deny	no	—	▸ allow
failureMode · component property	enum	open \| closed	no	closed	inherited
intrusionPrevention	boolean	—	no	—	▸ false
logging	boolean	—	no	—	▸ false
managed	boolean	—	no	false	▸ true
ruleAction · component property	enum	allow \| block \| alert	no	block	inherited
ruleCount	integer	—	no	—	inherited
stateful	boolean	—	no	—	▸ false

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "route53-dns-firewall", component: "aws-route53-dns-firewall" }

Other Firewall products · 35

Cloud Firewallalibaba-cloud-firewallalibabacloudfirewall Network ACLalibaba-network-aclalibabacloudfirewall ECS Security Groupalibaba-security-groupalibabacloudfirewall Network ACLaws-network-aclawsfirewall AWS Network Firewallaws-network-firewallawsfirewall Security groupaws-security-groupawsfirewall Microsoft Entra Internet Accessazure-entra-internet-accessazurefirewall Azure Firewallazure-firewallazurefirewall Network Security Groupazure-network-security-groupazurefirewall Network security perimeterazure-network-security-perimeterazurefirewall Cloudflare DNS Firewallcloudflare-dns-firewallcloudflarefirewall Cloudflare Gatewaycloudflare-gatewaycloudflarefirewall Cloudflare Network Firewallcloudflare-network-firewallcloudflarefirewall Generic firewallfirewallfirewall Firewall appliancefirewall-appliancefirewall Fortinet FortiGatefortigatefirewall MikroTik RouterOSmikrotik-routerosfirewall nftablesnftablesfirewall OPNsenseopnsensefirewall Palo Alto Networks NGFWpalo-alto-ngfwfirewall pfSensepfsensefirewall Snortsnortfirewall Suricatasuricatafirewall VyOSvyosfirewall DigitalOcean Cloud Firewallsdigitalocean-cloud-firewalldigitaloceanfirewall Cloud IDSgoogle-cloud-idsgcpfirewall Cloud NGFWgoogle-cloud-ngfwgcpfirewall Secure Web Proxygoogle-secure-web-proxygcpfirewall IBM Cloud Hardware Firewallibm-firewallibmfirewall VPC Security Groupibm-security-groupibmfirewall NetworkPolicyk8s-network-policyk8sfirewall Network Firewalloci-network-firewallocifirewall Network Security Groupoci-network-security-groupocifirewall Security Listoci-security-listocifirewall Security Groupoutscale-security-groupoutscalefirewall

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Amazon Route 53 Resolver DNS Firewall: rule groups associated with a VPC that filter outbound DNS
3# queries by domain name; queries that match no rule pass through ("Using DNS Firewall to filter
4# outbound DNS traffic"). Fail open is disabled by default, so the failure mode is closed
5# ("FirewallConfig"). Logging and metrics are configured separately.
6schemaVersion: "1"
7type: "component"
8id: "aws-route53-dns-firewall"
9kind: "firewall"
10provider: "aws"
11docs: "https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall.html"
12defaults:
13  managed: true
14  defaultAction: "allow"
15  stateful: false
16  logging: false
17  intrusionPrevention: false
18properties:
19  failureMode:
20    type: "enum"
21    values: ["open", "closed"]
22    default: "closed"
23  ruleAction:
24    type: "enum"
25    values: ["allow", "block", "alert"]
26    default: "block"
27  blockResponse:
28    type: "enum"
29    values: ["nodata", "nxdomain", "override"]
30  awsManagedDomainLists:
31    type: "boolean"
32    default: false

The same page as markdown, for an agent: /catalogue/components/aws-route53-dns-firewall.md