AWS cli: Add Route 53 resolved domain target type to Network Firewall
Summary
Documents the new AWS_ROUTE_53_RESOLVED_DOMAIN target type for Network Firewall domain matching, including how it combines with TLS_SNI/HTTP_HOST in allowlists and denylists to prevent spoofed Host/SNI bypass. Also updates Suricata documentation links and CLI version references.
Security assessment
The added documentation describes a security control that requires both domain-header matching and Route 53 Resolver IP validation in allowlists, explicitly preventing spoofed Host headers from bypassing firewall rules. This is security-relevant network filtering guidance.
Evidence
+>>>> * Combining `AWS_ROUTE_53_RESOLVED_DOMAIN` with `TLS_SNI` or `HTTP_HOST` in an `ALLOWLIST` requires both conditions to match. The SNI or `Host` header must match the domain, **and** the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed `Host` header sent to an unresolved IP address, is not allowed.
Diff
diff --git a/cli/latest/reference/network-firewall/update-rule-group.md b/cli/latest/reference/network-firewall/update-rule-group.md index 3e0975c..1867adf 100644 --- a//cli/latest/reference/network-firewall/update-rule-group.md +++ b//cli/latest/reference/network-firewall/update-rule-group.md @@ -15 +15 @@ - * [AWS CLI 2.38.3 Command Reference](../../index.html) » + * [AWS CLI 2.38.4 Command Reference](../../index.html) » @@ -296 +296,19 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ ->>>> The protocols you want to inspect. Specify `TLS_SNI` for `HTTPS` . Specify `HTTP_HOST` for `HTTP` . You can specify either or both. +>>>> The types of matching to perform against the domains in `Targets` . You can specify any combination of the following: +>>>> +>>>> * `AWS_ROUTE_53_RESOLVED_DOMAIN` – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection’s destination IP address for. +>>>> * `HTTP_HOST` – Match the domain against the `Host` header of HTTP traffic. +>>>> * `TLS_SNI` – Match the domain against the Server Name Indication (SNI) of HTTPS traffic. +>>>> + +>>>> +>>>>> `AWS_ROUTE_53_RESOLVED_DOMAIN` matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP `Host` header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation . +>>>> +>>>> Whether you include `AWS_ROUTE_53_RESOLVED_DOMAIN` changes what the generated rules match, together with `GeneratedRulesType` : +>>>> +>>>> * Combining `AWS_ROUTE_53_RESOLVED_DOMAIN` with `TLS_SNI` or `HTTP_HOST` in an `ALLOWLIST` requires both conditions to match. The SNI or `Host` header must match the domain, **and** the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed `Host` header sent to an unresolved IP address, is not allowed. +>>>> * In a `DENYLIST` , or when `AWS_ROUTE_53_RESOLVED_DOMAIN` is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or `Host` ) or the resolved destination IP address triggers the rule. +>>>> * When you don’t include `AWS_ROUTE_53_RESOLVED_DOMAIN` , the generated rules match only on the SNI or `Host` header, without checking how the destination IP address was resolved. +>>>> + +>>>> +>>>> An `ALLOWLIST` whose only target type is `AWS_ROUTE_53_RESOLVED_DOMAIN` is additive: it allows matching traffic but doesn’t generate a default rule that drops non-matching traffic. Only the `TLS_SNI` and `HTTP_HOST` target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well. @@ -303,0 +322 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ +>>>>> * `AWS_ROUTE_53_RESOLVED_DOMAIN` @@ -326 +345 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ ->>> An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html) . +>>> An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html) . @@ -330 +349 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ ->>>> A single Suricata rules specification, for use in a stateful rule group. Use this option to specify a simple Suricata rule with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html) . +>>>> A single Suricata rules specification, for use in a stateful rule group. Use this option to specify a simple Suricata rule with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html) . @@ -483 +502 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ ->>>>>>> The keyword for the Suricata compatible rule option. You must include a `sid` (signature ID), and can optionally include other keywords. For information about Suricata compatible keywords, see [Rule options](https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html#rule-options) in the Suricata documentation. +>>>>>>> The keyword for the Suricata compatible rule option. You must include a `sid` (signature ID), and can optionally include other keywords. For information about Suricata compatible keywords, see [Rule options](https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html#rule-options) in the Suricata documentation. @@ -495 +514 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/networ ->>>>>>> The settings of the Suricata compatible rule option. Rule options have zero or more setting values, and the number of possible and required settings depends on the `Keyword` . For more information about the settings for specific options, see [Rule options](https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html#rule-options) . +>>>>>>> The settings of the Suricata compatible rule option. Rule options have zero or more setting values, and the number of possible and required settings depends on the `Keyword` . For more information about the settings for specific options, see [Rule options](https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html#rule-options) . @@ -865 +884 @@ JSON Syntax: - "TargetTypes": ["TLS_SNI"|"HTTP_HOST", ...], + "TargetTypes": ["TLS_SNI"|"HTTP_HOST"|"AWS_ROUTE_53_RESOLVED_DOMAIN", ...], @@ -1342,0 +1362 @@ RuleGroupResponse -> (structure) +>> * `UPDATING` @@ -1535 +1555 @@ RuleGroupResponse -> (structure) - * [AWS CLI 2.38.3 Command Reference](../../index.html) » + * [AWS CLI 2.38.4 Command Reference](../../index.html) »