Saturday, May 18, 2024

Cease the CNAME chain battle: Simplified administration with Route 53 Resolver DNS Firewall


Voiced by Polly

Beginning immediately, you’ll be able to configure your DNS Firewall to mechanically belief all domains in a decision chain (akin to aCNAME, DNAME, or Alias chain).

Let’s stroll by this in nontechnical phrases for these unfamiliar with DNS.

Why use DNS Firewall?
DNS Firewall offers safety for outbound DNS requests out of your personal community within the cloud (Amazon Digital Personal Cloud (Amazon VPC)). These requests route by Amazon Route 53 Resolver for area title decision. Firewall directors can configure guidelines to filter and regulate the outbound DNS site visitors.

DNS Firewall helps to guard in opposition to a number of safety dangers.

Let’s think about a malicious actor managed to put in and run some code in your Amazon Elastic Compute Cloud (Amazon EC2) cases or containers working inside one in all your digital personal clouds (VPCs). The malicious code is prone to provoke outgoing community connections. It would achieve this to connect with a command server and obtain instructions to execute in your machine. Or it’d provoke connections to a third-party service in a coordinated distributed denial of service (DDoS) assault. It may also attempt to exfiltrate knowledge it managed to gather in your community.

Luckily, your community and safety teams are accurately configured. They block all outgoing site visitors besides the one to well-known API endpoints utilized by your app. To this point so good—the malicious code can’t dial again residence utilizing common TCP or UDP connections.

However what about DNS site visitors? The malicious code might ship DNS requests to an authoritative DNS server they management to both ship management instructions or encoded knowledge, and it may possibly obtain knowledge again within the response. I’ve illustrated the method within the following diagram.

DNS exfiltration illustrated

To forestall these situations, you should use a DNS Firewall to observe and management the domains that your functions can question. You possibly can deny entry to the domains that you recognize to be dangerous and permit all different queries to go by. Alternately, you’ll be able to deny entry to all domains besides these you explicitly belief.

What’s the problem with CNAME, DNAME, and Alias information?
Think about you configured your DNS Firewall to permit DNS queries solely to particular well-known domains and blocked all others. Your utility communicates with alexa.amazon.com; due to this fact, you created a rule permitting DNS site visitors to resolve that hostname.

Nonetheless, the DNS system has a number of forms of information. Those of curiosity on this article are

  • A information that map a DNS title to an IP handle,
  • CNAME information which are synonyms for different DNS names,
  • DNAME information that present redirection from part of the DNS title tree to a different a part of the DNS title tree, and
  • Alias information that present a Route 53 particular extension to DNS performance. Alias information allow you to route site visitors to chose AWS sources, akin to Amazon CloudFront distributions and Amazon S3 buckets

When querying alexa.amazon.com, I see it’s really a CNAME file that factors to pitangui.amazon.com, which is one other CNAME file that factors to tp.5fd53c725-frontier.amazon.com, which, in flip, is a CNAME to d1wg1w6p5q8555.cloudfront.web. Solely the final title (d1wg1w6p5q8555.cloudfront.web) has an A file related to an IP handle 3.162.42.28. The IP handle is prone to be completely different for you. It factors to the closest Amazon CloudFront edge location, doubtless the one from Paris (CDG52) for me.

The same redirection mechanism occurs when resolving DNAME or Alias information.

DNS resolution for alexa.amazon.com

To permit the entire decision of such a CNAME chain, you can be tempted to configure your DNS Firewall rule to permit all names beneath amazon.com (*.amazon.com), however that might fail to resolve the final CNAME that goes to cloudfront.web.

Worst, the DNS CNAME chain is managed by the service your utility connects to. The chain may change at any time, forcing you to manually keep the listing of guidelines and licensed domains inside your DNS Firewall guidelines.

Introducing DNS Firewall redirection chain authorization
Based mostly on this clarification, you’re now geared up to grasp the brand new functionality we launch immediately. We added a parameter to the UpdateFirewallRule API (additionally accessible on the AWS Command Line Interface (AWS CLI) and AWS Administration Console) to configure the DNS Firewall in order that it follows and mechanically trusts all of the domains in a CNAME, DNAME, or Alias chain.

This parameter permits firewall directors to solely enable the area your functions question. The firewall will mechanically belief all intermediate domains within the chain till it reaches the A file with the IP handle.

Let’s see it in motion
I begin with a DNS Firewall already configured with a area listing, a rule group, and a rule that ALLOW queries for the area alexa.amazon.com. The rule group is hooked up to a VPC the place I’ve an EC2 occasion began.

Once I connect with that EC2 occasion and concern a DNS question to resolve alexa.amazon.com, it solely returns the primary title within the area chain (pitangui.amazon.com) and stops there. That is anticipated as a result of pitangui.amazon.com will not be licensed to be resolved.

DNS query for alexa.amazon.com is blocked at first CNAME

To resolve this, I replace the firewall rule to belief your entire redirection chain. I exploit the AWS CLI to name the update-firewall-rule API with a brand new parameter firewall-domain-redirection-action set to TRUST_REDIRECTION_DOMAIN.

AWS CLI to update the DNS firewall rule

The next diagram illustrates the setup at this stage.

DNS Firewall rule diagram

Again to the EC2 occasion, I strive the DNS question once more. This time, it really works. It resolves your entire redirection chain, right down to the IP handle 🎉.

DNS resolution for the full CNAME chain

Due to the trusted chain redirection, community directors now have a straightforward technique to implement a technique to dam all domains and authorize solely recognized domains of their DNS Firewall with out having to care about CNAME, DNAME, or Alias chains.

This functionality is out there at no further price in all AWS Areas. Strive it out immediately!

— seb



Related Articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Stay Connected

0FansLike
3,912FollowersFollow
0SubscribersSubscribe
- Advertisement -spot_img

Latest Articles