Lecture 222: Route 53 DNS Firewall
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:57
- 来源：Udemy Lecture 33170764
- Slide 数量：4
- 画面切换：01:02、01:39、01:56
扫描说明
逐条读取了 Udemy 页面中的 64 条英文 Transcript cue，并按时间轴扫描全长约 02:57 的视频。依据 DNS Firewall Query Flow、Allow/Block List 与 Exfiltration、Firewall Manager/Logging、Fail-close vs Fail-open 划分为 4 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Resolver DNS Firewall 在 VPC Outbound DNS Query 上执行 Rule
时间范围：00:00–01:02
总结 / Summary
中文
Route 53 Resolver DNS Firewall 是 Managed Firewall，用于过滤 VPC Resource 经 Route 53 Resolver 发出的 Outbound DNS Request。EC2 查询 example.com 时，Resolver 先把 Domain 交给 DNS Firewall Rule 评估；若 Rule Block，该 Query 不再向外解析，EC2 得不到目标地址。控制点位于 Resolver 层，不要求每个 Instance 单独部署 Agent。
English
Route 53 Resolver DNS Firewall is a managed firewall that filters outbound DNS requests from VPC resources through Route 53 Resolver. When an EC2 instance queries example.com, the resolver evaluates the domain against firewall rules first. If blocked, resolution stops and the instance receives no target address. Enforcement occurs at the resolver rather than through per-instance agents.
Transcript
00:00 So let's talk about
00:01 the Route 53 Resolver DNS Firewall.
00:04 So this is a managed firewall,
00:06 and it enables you to filter outbound DNS requests
00:10 that are going out through your Route 53 Resolver
00:13 from your VPC.
00:15 So if you have a look at this diagram,
00:17 we see we have an EC2 instance
00:20 and is going to ask our Route 53 Resolver
00:24 for the DNS query for example.com.
00:28 Now we also have set up a Resolver DNS firewall,
00:32 and so the Route 53 Resolver is going to perform
00:37 the DNS query on the firewall saying, hey,
00:40 what about example.com?
00:42 And it's possible for us to set up rules on the firewall,
00:45 for example, to block this kind of domain,
00:47 we don't want to query for this domain.
00:49 Therefore the resolver will say,
00:52 back to the firewall, will say back to the resolver
00:54 that it's blocked and so therefore
00:57 the EC2 instance will not be able to resolve
00:59 the domain example.com from our resolver.
2. Blacklist 恶意 Domain、Whitelist 信任 Domain，阻断 DNS Exfiltration
时间范围：01:02–01:39
总结 / Summary
中文
Rule 可维护 Malicious Domain Blacklist 或 Trusted Domain Whitelist。攻击者常把窃取的数据编码进 DNS Query，发送到其控制的 Authoritative DNS Server，这称为 DNS Exfiltration。DNS Firewall 通过阻止未知或恶意 Domain 的 Query，降低 Compromised Application 依靠 DNS 这条通常被允许的通道把数据带出 VPC 的风险。
English
Rules can maintain a blacklist of malicious domains or a whitelist of trusted domains. Attackers may encode stolen data in DNS queries sent to an authoritative server they control, a technique called DNS exfiltration. Blocking unknown or malicious domains reduces the risk that a compromised application uses commonly allowed DNS traffic to move data out of a VPC.
Transcript
01:02 So why would we do this?
01:04 Well, this is to Blacklist any malicious domains
01:07 or to Whitelist trusted domains.
01:10 And what is the risk behind the DNS?
01:13 Well some attackers, they like to use the DNS protocol
01:17 to send data out.
01:19 So for example, the malicious attacker
01:21 will set up a DNS and through DNS queries
01:25 is going to send data to it
01:27 and it's called DNS exfiltration.
01:30 So it's just the little hack that can happen.
01:33 And so therefore you can manage a Whitelist
01:35 or a Blacklist of domains directly from your DNS firewall.
3. 用 AWS Firewall Manager 集中治理，并接入 DNS Query Logging
时间范围：01:39–01:56
总结 / Summary
中文
DNS Firewall Policy 可通过 AWS Firewall Manager 在组织范围集中配置和管理，适合跨 Account/VPC 统一下发 Domain List 与 Rule Group。可观测性方面，它与 CloudWatch Logs 及 Route 53 Resolver Query Logging 集成，使 Security Team 能看到被允许或阻止的 Query，结合 Firewall Action 排查异常解析与 Exfiltration 尝试。
English
DNS Firewall policies can be centrally configured across accounts and VPCs through AWS Firewall Manager, distributing domain lists and rule groups consistently. For observability, the firewall integrates with CloudWatch Logs and Route 53 Resolver query logging so security teams can inspect allowed or blocked queries and investigate anomalous resolution or exfiltration attempts.
Transcript
01:39 Now you can also manage the configuration of all this
01:42 from the overall service called AWS Firewall Manager.
01:46 And in case you wanna look at some logging
01:49 well you have integrations with CloudWatch Logs,
01:51 and also the Route 53 Resolver query logs that we just saw.
4. Fail-close 优先 Security；Fail-open 优先 Availability
时间范围：01:56–02:57
总结 / Summary
中文
当 DNS Firewall 无法响应时，Fail-close 让 Resolver Block Query：Firewall 故障会导致所有相关 DNS Query 被拒绝，选择 Security over Availability。Fail-open 则允许 Query 继续解析，即使 Firewall Down 仍保留业务 DNS，选择 Availability over Security。考试会根据场景要求在两者间取舍：严格数据防泄漏倾向 Fail-close，高可用关键业务倾向 Fail-open。
English
If DNS Firewall cannot respond, fail-close makes the resolver block the query. A firewall outage can therefore stop all affected DNS traffic, choosing security over availability. Fail-open lets queries continue when the firewall is unavailable, choosing availability over security. Strict exfiltration prevention favors fail-close, while highly available workloads may favor fail-open.
Transcript
01:56 Now, one important piece of information
01:58 and configuration need to know for the exam
02:00 is the DNS firewall configuration.
02:02 And you have two ways of configuring it,
02:05 Fail-close, or Fail-open.
02:07 So Fail-close is going to make sure that if you don't have
02:12 any response for your DNS firewall,
02:14 for example, if it's down or there's a problem on AWS,
02:17 if there is no response then the resolver
02:19 is going to block the query.
02:21 So this is to have security over availability.
02:26 That means that if your Resolver DNS Firewall is down
02:29 then all DNS queries will just block, okay.
02:33 But if you have Fail-open
02:35 that means that if your DNS firewall is down
02:38 then the resolver will allow the query,
02:41 and this is to make sure that you have
02:43 availability over security.
02:45 So this is something the exam will ask you
02:47 and you'll have to choose between Fail-open
02:48 and Fail-close at some point during maybe a question.
02:52 Okay, that's it for this lecture.
02:54 I hope you liked it.
02:55 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Route 53 Resolver DNS Firewall 在 VPC Resolver 层过滤 Outbound DNS，可用 Allow/Block Domain List 缓解恶意解析和 DNS Exfiltration，并由 Firewall Manager 集中治理、通过 CloudWatch/Resolver Log 观测。Fail-close 在 Firewall 无响应时阻断 Query，偏安全；Fail-open 允许 Query，偏可用性。
English
Route 53 Resolver DNS Firewall filters outbound DNS at the VPC resolver, using allow or block domain lists to mitigate malicious resolution and DNS exfiltration. Firewall Manager provides centralized governance and CloudWatch or Resolver logs provide visibility. Fail-close blocks queries when the firewall cannot respond, prioritizing security; fail-open allows them, prioritizing availability.
返回顶部 ↑