High-level information about a list of firewall domains for use in a [AWS::Route53Resolver::FirewallRule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53resolver-firewallrulegroup-rule.html) . This is returned by [GetFirewallDomainList](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallDomainList.html) .

To retrieve the domains that are defined for this domain list, call [ListFirewallDomains](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallDomains.html) .

CfnFirewallDomainList

The fully qualified URL or URI of the file stored in Amazon Simple Storage Service (Amazon S3) that contains the list of domains to import.

The file must be in an S3 bucket that's in the same Region as your DNS Firewall. The file must be a text file and must contain a single domain per line.

domainFileUrl

A list of the domain lists that you have defined.

domains

name

A list of the tag keys and values that you want to associate with the domain list.

CfnFirewallRuleGroup

A list of the rules that you have defined.

firewallRules

A list of the tag keys and values that you want to associate with the rule group.

An association between a firewall rule group and a VPC, which enables DNS filtering for the VPC.

CfnFirewallRuleGroupAssociation

The unique identifier of the firewall rule group.

firewallRuleGroupId

The setting that determines the processing order of the rule group among the rule groups that are associated with a single VPC.

DNS Firewall filters VPC traffic starting from rule group with the lowest numeric priority setting.

You must specify a unique priority for each rule group that you associate with a single VPC. To make it easier to insert rule groups later, leave space between the numbers, for example, use 101, 200, and so on. You can change the priority setting for a rule group association after you create it.

The allowed values for `Priority` are between 100 and 9900 (excluding 100 and 9900).

priority

The unique identifier of the VPC that is associated with the rule group.

vpcId

If enabled, this setting disallows modification or removal of the association, to help prevent against accidentally altering DNS firewall protections.

mutationProtection

Creates a Amazon Route 53 Resolver on an Outpost.

CfnOutpostResolver

The ARN (Amazon Resource Name) for the Outpost.

outpostArn

The Amazon EC2 instance type.

If you specify this, you must also specify a value for the `OutpostArn` .

preferredInstanceType

Amazon EC2 instance count for the Resolver on the Outpost.

instanceCount

A key value pair that helps you identify a Route 53 Resolver .

A complex type that contains information about a Resolver configuration for a VPC.

CfnResolverConfig

Represents the desired status of `AutodefinedReverse` .

The only supported value on creation is `DISABLE` . Deletion of this resource will return `AutodefinedReverse` to its default value of `ENABLED` .

autodefinedReverseFlag

The ID of the Amazon Virtual Private Cloud VPC or a Route 53 Profile that you're configuring Resolver for.

resourceId

The `AWS::Route53Resolver::ResolverDNSSECConfig` resource is a complex type that contains information about a configuration for DNSSEC validation.

CfnResolverDNSSECConfig

The ID of the virtual private cloud (VPC) that you're configuring the DNSSEC validation status for.

Creates a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound:.

- An *inbound Resolver endpoint* forwards DNS queries to the DNS service for a VPC from your network.
- An *outbound Resolver endpoint* forwards DNS queries from the DNS service for a VPC to your network.

> - You cannot update `ResolverEndpointType` and `IpAddresses` in the same request.
> - When you update a dual-stack IP address, you must update both IP addresses. You can’t update only an IPv4 or IPv6 and keep an existing IP address.

CfnResolverEndpoint

Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:.

- `INBOUND` : allows DNS queries to your VPC from your network
- `OUTBOUND` : allows DNS queries from your VPC to your network
- `INBOUND_DELEGATION` : Resolver delegates queries to Route 53 private hosted zones from your network.

direction

The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints).

The subnet ID uniquely identifies a VPC.

> Even though the minimum is 1, Route 53 requires that you create at least two.

ipAddresses

The ID of one or more security groups that control access to this VPC.

The security group must include one or more inbound rules (for inbound endpoints) or outbound rules (for outbound endpoints). Inbound and outbound rules must allow TCP and UDP access. For inbound access, open port 53. For outbound access, open the port that you're using for DNS queries on your network.

securityGroupIds

A friendly name that lets you easily find a configuration in the Resolver dashboard in the Route 53 console.

Protocols used for the endpoint. DoH-FIPS is applicable for a default inbound endpoints only.

For an inbound endpoint you can apply the protocols as follows:

- Do53 and DoH in combination.
- Do53 and DoH-FIPS in combination.
- Do53 alone.
- DoH alone.
- DoH-FIPS alone.
- None, which is treated as Do53.

For a delegation inbound endpoint you can use Do53 only.

For an outbound endpoint you can apply the protocols as follows:

- Do53 and DoH in combination.
- Do53 alone.
- DoH alone.
- None, which is treated as Do53.

protocols

resolverEndpointType

Indicates whether RNI enhanced metrics are enabled for the Resolver endpoint.

When enabled, one-minute granular metrics are published in CloudWatch for each RNI associated with this endpoint. When disabled, these metrics are not published.

rniEnhancedMetricsEnabled

Route 53 Resolver doesn't support updating tags through CloudFormation.

Indicates whether target name server metrics are enabled for the outbound Resolver endpoint.

When enabled, one-minute granular metrics are published in CloudWatch for each target name server associated with this endpoint. When disabled, these metrics are not published. This feature is not supported for inbound Resolver endpoint.

targetNameServerMetricsEnabled

The AWS::Route53Resolver::ResolverQueryLoggingConfig resource is a complex type that contains settings for one query logging configuration.

CfnResolverQueryLoggingConfig

The ARN of the resource that you want Resolver to send query logs: an Amazon S3 bucket, a CloudWatch Logs log group, or a Kinesis Data Firehose delivery stream.

destinationArn

The name of the query logging configuration.

An array of key-value pairs to apply to this resource.

The AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation resource is a configuration for DNS query logging.

After you create a query logging configuration, Amazon Route 53 begins to publish log data to an Amazon CloudWatch Logs log group.

CfnResolverQueryLoggingConfigAssociation

The ID of the query logging configuration that a VPC is associated with.

resolverQueryLogConfigId

The ID of the Amazon VPC that is associated with the query logging configuration.

For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.

CfnResolverRule

When you want to forward DNS queries for specified domain name to resolvers on your network, specify `FORWARD` or `DELEGATE` .

If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com).

When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify `SYSTEM` .

For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify `FORWARD` for `RuleType` . To then have Resolver process queries for apex.example.com, you create a rule and specify `SYSTEM` for `RuleType` .

Currently, only Resolver can create rules that have a value of `RECURSIVE` for `RuleType` .

ruleType

DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.

delegationRecord

DNS queries for this domain name are forwarded to the IP addresses that are specified in `TargetIps` .

If a query matches multiple Resolver rules (example.com and www.example.com), the query is routed using the Resolver rule that contains the most specific domain name (www.example.com).

domainName

The name for the Resolver rule, which you specified when you created the Resolver rule.

The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.

The ID of the endpoint that the rule is associated with.

resolverEndpointId

Tags help organize and categorize your Resolver rules.

Each tag consists of a key and an optional value, both of which you define.

An array that contains the IP addresses and ports that an outbound endpoint forwards DNS queries to.

Typically, these are the IP addresses of DNS resolvers on your network.

targetIps

In the response to an [AssociateResolverRule](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverRule.html) , [DisassociateResolverRule](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverRule.html) , or [ListResolverRuleAssociations](https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverRuleAssociations.html) request, provides information about an association between a resolver rule and a VPC. The association determines which DNS queries that originate in the VPC are forwarded to your network.

CfnResolverRuleAssociation

The ID of the Resolver rule that you associated with the VPC that is specified by `VPCId` .

resolverRuleId

The ID of the VPC that you associated the Resolver rule with.

The name of an association between a Resolver rule and a VPC.

The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.

AWS route53resolver

L1 Constructs11