DNS Firewall with Fail-Open Stated, Not Inherited

aws-dns-firewall

A Route 53 Resolver DNS Firewall: domain lists, a rule group, its rules, and the VPC associations that put it in the path. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

Fail-open is an availability decision wearing a security name, and it is the setting here worth thinking about twice.

• fail_open = false (the default, and AWS's) fails a query the firewall cannot evaluate. Nothing unfiltered gets through - and a firewall problem becomes a DNS outage for every host in the VPC
• fail_open = true resolves those queries unfiltered. The application keeps working and the control is not applied, without saying so

Neither is wrong. Choosing by accident is, which is why this module states it rather than inheriting it.

An ALERT rule is not a control. It logs the query and resolves it. That is how you find out what a rule would break before you turn it on, and it is not protection - the two look the same in the console, so the alert_only_rules output lists them by name.

Other things it gets right that are easy to get wrong by hand:

• example.com and *.example.com are two different entries. There is no leading-dot shorthand, and listing only the bare name leaves every subdomain resolving
• Rule priorities are validated unique, in range, and the docs push you toward gaps - inserting between two adjacent priorities means renumbering the rest
• mutation_protection is on: rule groups get detached during incidents by people who mean well
• A BLOCK rule without a block_response, and an OVERRIDE without a domain, are both refused by preconditions rather than by the API several minutes in

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.