View a markdown version of this page

AWS::Route53Resolver::FirewallConfig - AWS CloudFormation
SyntaxPropertiesReturn values

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::Route53Resolver::FirewallConfig

Configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Route53Resolver::FirewallConfig",
  "Properties" : {
      "FirewallFailOpen" : String,
      "ResourceId" : String
    }
}

YAML

Type: AWS::Route53Resolver::FirewallConfig
Properties:
  FirewallFailOpen: String
  ResourceId: String

Properties

FirewallFailOpen

Determines how DNS Firewall operates during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply.

  • By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall returns a failure error when it is unable to properly evaluate a query.

  • If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them.

This behavior is only enforced for VPCs that have at least one DNS Firewall rule group association.

Required: No

Type: String

Allowed values: ENABLED | DISABLED | USE_LOCAL_RESOURCE_SETTING

Update requires: Replacement

ResourceId

The ID of the VPC that this firewall configuration applies to.

Required: No

Type: String

Minimum: 1

Maximum: 64

Update requires: Replacement

Return values

Ref

Fn::GetAtt

Arn

Property description not available.

Id

The ID of the firewall configuration.

OwnerId

The AWS account ID of the owner of the VPC that this firewall configuration applies to.