From 033426bc414dee40781eb31daae89e4fd6e213ee Mon Sep 17 00:00:00 2001 From: awstools Date: Fri, 15 Nov 2024 19:12:00 +0000 Subject: [PATCH] feat(client-route53resolver): Route 53 Resolver DNS Firewall Advanced Rules allows you to monitor and block suspicious DNS traffic based on anomalies detected in the queries, such as DNS tunneling and Domain Generation Algorithms (DGAs). --- .../src/commands/CreateFirewallRuleCommand.ts | 7 +- .../src/commands/DeleteFirewallRuleCommand.ts | 10 +- .../src/commands/ListFirewallRulesCommand.ts | 3 + .../src/commands/UpdateFirewallRuleCommand.ts | 8 +- .../src/models/models_0.ts | 250 +++++++++++++----- .../src/protocols/Aws_json1_1.ts | 2 + .../aws-models/route53resolver.json | 126 +++++++-- 7 files changed, 328 insertions(+), 78 deletions(-) diff --git a/clients/client-route53resolver/src/commands/CreateFirewallRuleCommand.ts b/clients/client-route53resolver/src/commands/CreateFirewallRuleCommand.ts index fe05988b8c50..10887347de98 100644 --- a/clients/client-route53resolver/src/commands/CreateFirewallRuleCommand.ts +++ b/clients/client-route53resolver/src/commands/CreateFirewallRuleCommand.ts @@ -38,7 +38,7 @@ export interface CreateFirewallRuleCommandOutput extends CreateFirewallRuleRespo * const input = { // CreateFirewallRuleRequest * CreatorRequestId: "STRING_VALUE", // required * FirewallRuleGroupId: "STRING_VALUE", // required - * FirewallDomainListId: "STRING_VALUE", // required + * FirewallDomainListId: "STRING_VALUE", * Priority: Number("int"), // required * Action: "ALLOW" || "BLOCK" || "ALERT", // required * BlockResponse: "NODATA" || "NXDOMAIN" || "OVERRIDE", @@ -48,6 +48,8 @@ export interface CreateFirewallRuleCommandOutput extends CreateFirewallRuleRespo * Name: "STRING_VALUE", // required * FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * Qtype: "STRING_VALUE", + * DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * }; * const command = new CreateFirewallRuleCommand(input); * const response = await client.send(command); @@ -55,6 +57,7 @@ export interface CreateFirewallRuleCommandOutput extends CreateFirewallRuleRespo * // FirewallRule: { // FirewallRule * // FirewallRuleGroupId: "STRING_VALUE", * // FirewallDomainListId: "STRING_VALUE", + * // FirewallThreatProtectionId: "STRING_VALUE", * // Name: "STRING_VALUE", * // Priority: Number("int"), * // Action: "ALLOW" || "BLOCK" || "ALERT", @@ -67,6 +70,8 @@ export interface CreateFirewallRuleCommandOutput extends CreateFirewallRuleRespo * // ModificationTime: "STRING_VALUE", * // FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * // Qtype: "STRING_VALUE", + * // DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * // ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * // }, * // }; * diff --git a/clients/client-route53resolver/src/commands/DeleteFirewallRuleCommand.ts b/clients/client-route53resolver/src/commands/DeleteFirewallRuleCommand.ts index e856e5b8323f..e0c6ee9e0895 100644 --- a/clients/client-route53resolver/src/commands/DeleteFirewallRuleCommand.ts +++ b/clients/client-route53resolver/src/commands/DeleteFirewallRuleCommand.ts @@ -37,7 +37,8 @@ export interface DeleteFirewallRuleCommandOutput extends DeleteFirewallRuleRespo * const client = new Route53ResolverClient(config); * const input = { // DeleteFirewallRuleRequest * FirewallRuleGroupId: "STRING_VALUE", // required - * FirewallDomainListId: "STRING_VALUE", // required + * FirewallDomainListId: "STRING_VALUE", + * FirewallThreatProtectionId: "STRING_VALUE", * Qtype: "STRING_VALUE", * }; * const command = new DeleteFirewallRuleCommand(input); @@ -46,6 +47,7 @@ export interface DeleteFirewallRuleCommandOutput extends DeleteFirewallRuleRespo * // FirewallRule: { // FirewallRule * // FirewallRuleGroupId: "STRING_VALUE", * // FirewallDomainListId: "STRING_VALUE", + * // FirewallThreatProtectionId: "STRING_VALUE", * // Name: "STRING_VALUE", * // Priority: Number("int"), * // Action: "ALLOW" || "BLOCK" || "ALERT", @@ -58,6 +60,8 @@ export interface DeleteFirewallRuleCommandOutput extends DeleteFirewallRuleRespo * // ModificationTime: "STRING_VALUE", * // FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * // Qtype: "STRING_VALUE", + * // DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * // ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * // }, * // }; * @@ -83,6 +87,10 @@ export interface DeleteFirewallRuleCommandOutput extends DeleteFirewallRuleRespo * @throws {@link ThrottlingException} (client fault) *

The request was throttled. Try again in a few minutes.

* + * @throws {@link ValidationException} (client fault) + *

You have provided an invalid command. If you ran the UpdateFirewallDomains request. supported values are ADD, + * REMOVE, or REPLACE a domain.

+ * * @throws {@link Route53ResolverServiceException} *

Base exception class for all service exceptions from Route53Resolver service.

* diff --git a/clients/client-route53resolver/src/commands/ListFirewallRulesCommand.ts b/clients/client-route53resolver/src/commands/ListFirewallRulesCommand.ts index aa3ddce4015c..e28c6906c471 100644 --- a/clients/client-route53resolver/src/commands/ListFirewallRulesCommand.ts +++ b/clients/client-route53resolver/src/commands/ListFirewallRulesCommand.ts @@ -51,6 +51,7 @@ export interface ListFirewallRulesCommandOutput extends ListFirewallRulesRespons * // { // FirewallRule * // FirewallRuleGroupId: "STRING_VALUE", * // FirewallDomainListId: "STRING_VALUE", + * // FirewallThreatProtectionId: "STRING_VALUE", * // Name: "STRING_VALUE", * // Priority: Number("int"), * // Action: "ALLOW" || "BLOCK" || "ALERT", @@ -63,6 +64,8 @@ export interface ListFirewallRulesCommandOutput extends ListFirewallRulesRespons * // ModificationTime: "STRING_VALUE", * // FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * // Qtype: "STRING_VALUE", + * // DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * // ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * // }, * // ], * // }; diff --git a/clients/client-route53resolver/src/commands/UpdateFirewallRuleCommand.ts b/clients/client-route53resolver/src/commands/UpdateFirewallRuleCommand.ts index 407a363a4536..6e249700c5cc 100644 --- a/clients/client-route53resolver/src/commands/UpdateFirewallRuleCommand.ts +++ b/clients/client-route53resolver/src/commands/UpdateFirewallRuleCommand.ts @@ -37,7 +37,8 @@ export interface UpdateFirewallRuleCommandOutput extends UpdateFirewallRuleRespo * const client = new Route53ResolverClient(config); * const input = { // UpdateFirewallRuleRequest * FirewallRuleGroupId: "STRING_VALUE", // required - * FirewallDomainListId: "STRING_VALUE", // required + * FirewallDomainListId: "STRING_VALUE", + * FirewallThreatProtectionId: "STRING_VALUE", * Priority: Number("int"), * Action: "ALLOW" || "BLOCK" || "ALERT", * BlockResponse: "NODATA" || "NXDOMAIN" || "OVERRIDE", @@ -47,6 +48,8 @@ export interface UpdateFirewallRuleCommandOutput extends UpdateFirewallRuleRespo * Name: "STRING_VALUE", * FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * Qtype: "STRING_VALUE", + * DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * }; * const command = new UpdateFirewallRuleCommand(input); * const response = await client.send(command); @@ -54,6 +57,7 @@ export interface UpdateFirewallRuleCommandOutput extends UpdateFirewallRuleRespo * // FirewallRule: { // FirewallRule * // FirewallRuleGroupId: "STRING_VALUE", * // FirewallDomainListId: "STRING_VALUE", + * // FirewallThreatProtectionId: "STRING_VALUE", * // Name: "STRING_VALUE", * // Priority: Number("int"), * // Action: "ALLOW" || "BLOCK" || "ALERT", @@ -66,6 +70,8 @@ export interface UpdateFirewallRuleCommandOutput extends UpdateFirewallRuleRespo * // ModificationTime: "STRING_VALUE", * // FirewallDomainRedirectionAction: "INSPECT_REDIRECTION_DOMAIN" || "TRUST_REDIRECTION_DOMAIN", * // Qtype: "STRING_VALUE", + * // DnsThreatProtection: "DGA" || "DNS_TUNNELING", + * // ConfidenceThreshold: "LOW" || "MEDIUM" || "HIGH", * // }, * // }; * diff --git a/clients/client-route53resolver/src/models/models_0.ts b/clients/client-route53resolver/src/models/models_0.ts index 4dcc955f4bdf..26a77aefb214 100644 --- a/clients/client-route53resolver/src/models/models_0.ts +++ b/clients/client-route53resolver/src/models/models_0.ts @@ -906,7 +906,7 @@ export interface ResolverQueryLogConfigAssociation { * *
  • *

    - * CREATED: The association between an Amazon VPC and a query logging configuration + * ACTIVE: The association between an Amazon VPC and a query logging configuration * was successfully created. Resolver is logging queries that originate in the specified VPC.

    *
    • *
  • @@ -1137,6 +1137,21 @@ export const BlockResponse = { */ export type BlockResponse = (typeof BlockResponse)[keyof typeof BlockResponse]; +/** + * @public + * @enum + */ +export const ConfidenceThreshold = { + HIGH: "HIGH", + LOW: "LOW", + MEDIUM: "MEDIUM", +} as const; + +/** + * @public + */ +export type ConfidenceThreshold = (typeof ConfidenceThreshold)[keyof typeof ConfidenceThreshold]; + /** * @public */ @@ -1259,6 +1274,20 @@ export interface CreateFirewallDomainListResponse { FirewallDomainList?: FirewallDomainList | undefined; } +/** + * @public + * @enum + */ +export const DnsThreatProtection = { + DGA: "DGA", + DNS_TUNNELING: "DNS_TUNNELING", +} as const; + +/** + * @public + */ +export type DnsThreatProtection = (typeof DnsThreatProtection)[keyof typeof DnsThreatProtection]; + /** * @public * @enum @@ -1293,10 +1322,10 @@ export interface CreateFirewallRuleRequest { FirewallRuleGroupId: string | undefined; /** - *

    The ID of the domain list that you want to use in the rule.

    + *

    The ID of the domain list that you want to use in the rule. Can't be used together with DnsThreatProtecton.

    * @public */ - FirewallDomainListId: string | undefined; + FirewallDomainListId?: string | undefined; /** *

    The setting that determines the processing order of the rule in the rule group. DNS Firewall @@ -1309,11 +1338,11 @@ export interface CreateFirewallRuleRequest { Priority: number | undefined; /** - *

    The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list:

    + *

    The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list, or a threat in a DNS Firewall Advanced rule:

    *