Amazon Route 53 Global Resolver
Anycast recursive DNS resolver with client authentication and query filtering.
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| anycast | boolean | — | no | false | ▸ true |
| clientAuthentication | enum | cidr-allowlist | access-token | no | — | inherited |
| dnssecValidation | boolean | — | no | — | inherited |
| ednsClientSubnet | boolean | — | no | — | inherited |
| encryptedTransport | enum | do53 | doh | dot | no | do53 | inherited |
| geoRouting | boolean | — | no | false | inherited |
| healthChecked | boolean | — | no | false | inherited |
| managed | boolean | — | no | true | ▸ true |
| queryFiltering | boolean | — | no | false | inherited |
| redundantProviders | boolean | — | no | false | ▸ false |
| ttlSeconds | integer | — | no | — | inherited |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
shared-dependency-without-redundancy
The design requires redundant discovery, but this DNS or coordination service, which everything depends on, runs on a single provider or a single replica. Its failure is the whole system's failure.
- — all of these hold:
- — the design requirement `availability.discoveryRedundant` is true
- — any of these hold:
- — the node's `redundantProviders` is false
- — the node's `replicated` is false
nodes:
- { id: "route53-global-resolver", component: "aws-route53-global-resolver" }Alibaba Cloud DNSalibaba-dnsAlibaba Cloud Domain Namesalibaba-domainsAlibaba Cloud DNS PrivateZonealibaba-private-zoneAmazon Application Recovery Controller (ARC)aws-application-recovery-controllerAmazon Route 53 Resolver endpointaws-route53-resolverAmazon Route 53route53Azure DNSazure-dnsAzure DNS Private Resolverazure-dns-private-resolverAzure Private DNSazure-private-dnsAzure Traffic Managerazure-traffic-managerCloudflare DNScloudflare-dnsCloudflare Internal DNScloudflare-internal-dnsCloudflare Registrarcloudflare-registrarCloudflare Secondary DNScloudflare-secondary-dnsBIND 9bindCoreDNScorednsGeneric DNSdnsDNSdns-resolverdnsmasqdnsmasqExternalDNSexternal-dnsKnot DNSknot-dnsIBM NS1 Connectns1Pi-holepi-holePowerDNS Authoritative ServerpowerdnsUnboundunboundDigitalOcean DNSdigitalocean-dnsGoogle Cloud DNSgoogle-cloud-dnsCloud Domainsgoogle-cloud-domainsIBM Cloud DNS Servicesibm-dns-servicesDNS Private Zoneoci-dns-private-zoneDNS Public Zoneoci-dns-zoneTraffic Management Steering Policyoci-traffic-managementOpenStack Designateopenstack-designate
# yaml-language-server: $schema=../../schema/component.schema.json # Amazon Route 53 Global Resolver: an internet-reachable recursive resolver on a single set of anycast # IP addresses that answers for public domains and for associated Route 53 private hosted zones. # "What is Route 53 Global Resolver?" says it accepts traffic only from known clients (CIDR allowlists # for Do53, DoT and DoH, plus access tokens for DoT and DoH), filters queries with DNS Firewall rules # and AWS managed domain lists, and supports DNSSEC validation and EDNS client subnet per DNS view. schemaVersion: "1" type: "component" id: "aws-route53-global-resolver" kind: "dns" provider: "aws" docs: "https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/gr-what-is-global-resolver.html" defaults: managed: true anycast: true redundantProviders: false properties: encryptedTransport: type: "enum" values: ["do53", "doh", "dot"] default: "do53" dnssecValidation: type: "boolean" queryFiltering: type: "boolean" default: false ednsClientSubnet: type: "boolean" clientAuthentication: type: "enum" values: ["cidr-allowlist", "access-token"]