AWS Route53 documentation change
Summary
Added section on mitigating false positives in DNS Firewall Advanced protections through rule prioritization
Security assessment
Provides operational guidance for configuring security controls but does not address a specific vulnerability. Enhances documentation about existing security feature usage.
Diff
diff --git a/Route53/latest/DeveloperGuide/firewall-advanced.md b/Route53/latest/DeveloperGuide/firewall-advanced.md index fb4d3a170..7a9ed4015 100644 --- a//Route53/latest/DeveloperGuide/firewall-advanced.md +++ b//Route53/latest/DeveloperGuide/firewall-advanced.md @@ -25,0 +26,15 @@ To learn how to create rules, see [Creating a rule group and rules](./resolver-d +###### Mitigating false positive scenarios + +If you are encountering false-positive scenarios in rules that use DNS Firewall Advanced protections to block queries, perform the following steps: + + 1. In the Resolver logs, identify the rule group and DNS Firewall Advanced protections that are causing the false positive. You do this by finding the log for the query that DNS Firewall is blocking, but that you want to allow through. The log record lists the rule group, rule action, and the DNS Firewall Advanced protection. For information about the logs, see [Values that appear in Resolver query logs](./resolver-query-logs-format.html). + + 2. Create a new rule in the rule group that explicitly allows the blocked query through. When you create the rule, you can define your own domain list with just the domain specification that you want to allow. Follow the guidance for rule group and rule management at [Creating a rule group and rules](./resolver-dns-firewall-rule-group-adding.html). + + 3. Prioritize the new rule inside the rule group so that it runs before the rule that's using the managed list. To do this, give the new rule a lower numeric priority setting. + + + + +When you have updated your rule group, the new rule will explicitly allow the domain name that you want to allow before the blocking rule runs. +