firewall_rules

Creates, updates, deletes, gets or lists a firewall_rules resource.

Overview

Name	firewall_rules
Type	Resource
Id	aws.route53globalresolver.firewall_rules

Fields

The following fields are returned by SELECT queries:

list_firewall_rules

Name	Datatype	Description
id	string	The unique identifier of the firewall rule. (pattern: <code>[-.a-zA-Z0-9]+</code>)
name	string	The name of the firewall rule. (pattern: <code>(?!^[0-9]+$)([a-zA-Z0-9-_/' ']+)</code>)
action	string	The action configured for the firewall rule. (ALLOW, ALERT, BLOCK)
block_override_dns_type	string	The DNS record type configured for the firewall rule's custom response. (CNAME)
block_override_domain	string	The custom domain name configured for the firewall rule's BLOCK response. (pattern: <code>*?[a-zA-Z0-9!"#$%&'()*+,./:;<=>?@&#91;\&#93;^_`{|}~-]+</code>)
block_override_ttl	integer	The TTL value configured for the firewall rule's custom response.
block_response	string	The type of block response configured for the firewall rule. (NODATA, NXDOMAIN, OVERRIDE)
confidence_threshold	string	The confidence threshold configured for the firewall rule's advanced threat detection. (LOW, MEDIUM, HIGH)
created_at	string (date-time)	The date and time when the firewall rule was created.
description	string	The description of the firewall rule.
dns_advanced_protection	string	Whether advanced DNS threat protection is enabled for the firewall rule. (DGA, DNS_TUNNELING, DICTIONARY_DGA)
dns_view_id	string	The ID of the DNS view associated with the firewall rule. (pattern: <code>[-.a-zA-Z0-9]+</code>)
firewall_domain_list_id	string	The ID of the firewall domain list associated with the firewall rule. (pattern: <code>[-.a-zA-Z0-9]+</code>)
priority	integer (int64)	The priority of the firewall rule.
query_type	string	The DNS query type that the firewall rule matches.
status	string	The current status of the firewall rule. (CREATING, OPERATIONAL, UPDATING, DELETING)
updated_at	string (date-time)	The date and time when the firewall rule was last updated.

get_firewall_rule

Name	Datatype	Description
id	string	ID of the DNS Firewall rule. (pattern: <code>[-.a-zA-Z0-9]+</code>)
name	string	The name of the DNS Firewall rule. (pattern: <code>(?!^[0-9]+$)([a-zA-Z0-9-_/' ']+)</code>)
action	string	The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list, or a threat in a DNS Firewall Advanced rule. (ALLOW, ALERT, BLOCK)
block_override_dns_type	string	The DNS record's type. This determines the format of the record value that you provided in BlockOverrideDomain. Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE. (CNAME)
block_override_domain	string	The custom DNS record to send back in response to the query. Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE. (pattern: <code>*?[a-zA-Z0-9!"#$%&'()*+,./:;<=>?@&#91;\&#93;^_`{|}~-]+</code>)
block_override_ttl	integer	The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record. Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE.
block_response	string	The way that you want DNS Firewall to block the request. Used for the rule action setting BLOCK. (NODATA, NXDOMAIN, OVERRIDE)
confidence_threshold	string	The confidence threshold for DNS Firewall Advanced. You must provide this value when you create a DNS Firewall Advanced rule. (LOW, MEDIUM, HIGH)
created_at	string (date-time)	The time and date the DNS Firewall rule was created.
description	string	The description of the DNS Firewall rule.
dns_advanced_protection	string	The type of the DNS Firewall Advanced rule. Valid values are DGA, DNS_TUNNELING, and DICTIONARY_DGA. (DGA, DNS_TUNNELING, DICTIONARY_DGA)
dns_view_id	string	The DNS view ID the DNS Firewall is associated with. (pattern: <code>[-.a-zA-Z0-9]+</code>)
firewall_domain_list_id	string	The ID of a DNS Firewall domain list. (pattern: <code>[-.a-zA-Z0-9]+</code>)
priority	integer (int64)	The setting that determines the processing order of the rule in the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.
query_type	string	The DNS query type you want the rule to evaluate.
status	string	The operational status of the DNS Firewall rule. (CREATING, OPERATIONAL, UPDATING, DELETING)
updated_at	string (date-time)	The date and time the DNS Firewall rule was updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_firewall_rules	select	dnsview_id, region	max_results, next_token, filters	Lists all DNS firewall rules for a DNS view with pagination support. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.
get_firewall_rule	select	firewall_rule_id, region		Retrieves information about a DNS firewall rule. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.
create_firewall_rule	insert	region, action, name, dnsViewId		Creates a DNS firewall rule. Firewall rules define actions (ALLOW, BLOCK, or ALERT) to take on DNS queries that match specified domain lists, managed domain lists, or advanced threat protections. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.
update_firewall_rule	update	firewall_rule_id, region, clientToken		Updates the configuration of a DNS firewall rule. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.
delete_firewall_rule	delete	firewall_rule_id, region		Deletes a DNS firewall rule. This operation cannot be undone. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
dnsview_id	string	ID of the DNS view.
firewall_rule_id	string	The unique identifier of the firewall rule to delete.
region	string	AWS region (default: us-east-1)
filters	object	Values to filter the results.
max_results	integer	The maximum number of results to retrieve in a single call.
next_token	string	A pagination token used for large sets of results that can't be returned in a single response.

SELECT examples

list_firewall_rules

Lists all DNS firewall rules for a DNS view with pagination support. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

SELECT
id,
name,
action,
block_override_dns_type,
block_override_domain,
block_override_ttl,
block_response,
confidence_threshold,
created_at,
description,
dns_advanced_protection,
dns_view_id,
firewall_domain_list_id,
priority,
query_type,
status,
updated_at
FROM aws.route53globalresolver.firewall_rules
WHERE dnsview_id = '{{ dnsview_id }}' -- required
AND region = '{{ region }}' -- required
AND max_results = '{{ max_results }}'
AND next_token = '{{ next_token }}'
AND filters = '{{ filters }}'
;

get_firewall_rule

Retrieves information about a DNS firewall rule. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

SELECT
id,
name,
action,
block_override_dns_type,
block_override_domain,
block_override_ttl,
block_response,
confidence_threshold,
created_at,
description,
dns_advanced_protection,
dns_view_id,
firewall_domain_list_id,
priority,
query_type,
status,
updated_at
FROM aws.route53globalresolver.firewall_rules
WHERE firewall_rule_id = '{{ firewall_rule_id }}' -- required
AND region = '{{ region }}' -- required
;

INSERT examples

create_firewall_rule

Creates a DNS firewall rule. Firewall rules define actions (ALLOW, BLOCK, or ALERT) to take on DNS queries that match specified domain lists, managed domain lists, or advanced threat protections. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

INSERT INTO aws.route53globalresolver.firewall_rules (
action,
blockOverrideDnsType,
blockOverrideDomain,
blockOverrideTtl,
blockResponse,
clientToken,
confidenceThreshold,
description,
dnsAdvancedProtection,
firewallDomainListId,
name,
priority,
dnsViewId,
qType,
region
)
SELECT 
'{{ action }}' /* required */,
'{{ blockOverrideDnsType }}',
'{{ blockOverrideDomain }}',
{{ blockOverrideTtl }},
'{{ blockResponse }}',
'{{ clientToken }}',
'{{ confidenceThreshold }}',
'{{ description }}',
'{{ dnsAdvancedProtection }}',
'{{ firewallDomainListId }}',
'{{ name }}' /* required */,
{{ priority }},
'{{ dnsViewId }}' /* required */,
'{{ qType }}',
'{{ region }}'
RETURNING
id,
name,
action,
block_override_dns_type,
block_override_domain,
block_override_ttl,
block_response,
confidence_threshold,
created_at,
description,
dns_advanced_protection,
dns_view_id,
firewall_domain_list_id,
priority,
query_type,
status,
updated_at
;

Manifest

# Description fields are for documentation purposes
- name: firewall_rules
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the firewall_rules resource.
  - name: action
    value: "{{ action }}"
    valid_values: ['ALLOW', 'ALERT', 'BLOCK']
  - name: blockOverrideDnsType
    value: "{{ blockOverrideDnsType }}"
    valid_values: ['CNAME']
  - name: blockOverrideDomain
    value: "{{ blockOverrideDomain }}"
  - name: blockOverrideTtl
    value: {{ blockOverrideTtl }}
  - name: blockResponse
    value: "{{ blockResponse }}"
    valid_values: ['NODATA', 'NXDOMAIN', 'OVERRIDE']
  - name: clientToken
    value: "{{ clientToken }}"
  - name: confidenceThreshold
    value: "{{ confidenceThreshold }}"
    valid_values: ['LOW', 'MEDIUM', 'HIGH']
  - name: description
    value: "{{ description }}"
  - name: dnsAdvancedProtection
    value: "{{ dnsAdvancedProtection }}"
    valid_values: ['DGA', 'DNS_TUNNELING', 'DICTIONARY_DGA']
  - name: firewallDomainListId
    value: "{{ firewallDomainListId }}"
  - name: name
    value: "{{ name }}"
  - name: priority
    value: {{ priority }}
  - name: dnsViewId
    value: "{{ dnsViewId }}"
  - name: qType
    value: "{{ qType }}"

UPDATE examples

update_firewall_rule

Updates the configuration of a DNS firewall rule. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

UPDATE aws.route53globalresolver.firewall_rules
SET 
action = '{{ action }}',
blockOverrideDnsType = '{{ blockOverrideDnsType }}',
blockOverrideDomain = '{{ blockOverrideDomain }}',
blockOverrideTtl = {{ blockOverrideTtl }},
blockResponse = '{{ blockResponse }}',
clientToken = '{{ clientToken }}',
confidenceThreshold = '{{ confidenceThreshold }}',
description = '{{ description }}',
dnsAdvancedProtection = '{{ dnsAdvancedProtection }}',
name = '{{ name }}',
priority = {{ priority }}
WHERE 
firewall_rule_id = '{{ firewall_rule_id }}' --required
AND region = '{{ region }}' --required
AND clientToken = '{{ clientToken }}' --required
RETURNING
id,
name,
action,
block_override_dns_type,
block_override_domain,
block_override_ttl,
block_response,
confidence_threshold,
created_at,
description,
dns_advanced_protection,
dns_view_id,
firewall_domain_list_id,
priority,
query_type,
status,
updated_at;

DELETE examples

delete_firewall_rule

Deletes a DNS firewall rule. This operation cannot be undone. Route 53 Global Resolver is a global service that supports resolvers in multiple Amazon Web Services Regions but you must specify the US East (Ohio) Region to create, update, or otherwise work with Route 53 Global Resolver resources. That is, for example, specify --region us-east-2 on Amazon Web Services CLI commands.

DELETE FROM aws.route53globalresolver.firewall_rules
WHERE firewall_rule_id = '{{ firewall_rule_id }}' --required
AND region = '{{ region }}' --required
;