Associate DNS Firewall Rule Groups with VPCs

Table of Contents

Associate DNS Firewall Rule Groups with VPCs

Associate a DNS Firewall rule group containing Advanced DNS Security rules with one or more VPCs to enforce DNS threat protections across your organization.

Where Can I Use This?	What Do I Need?
Amazon Route 53 Resolver DNS Firewall	Advanced DNS Security subscription (active) DNS Firewall rule group with Palo Alto Networks rules Target VPCs identified

After creating DNS Firewall rules with Advanced DNS Security security categories, you associate the rule group containing those rules with one or more VPCs to begin enforcing DNS threat protections. You can associate a rule group with VPCs in the same account or share it across multiple AWS accounts in your organization.

DNS Firewall begins evaluating DNS queries from associated VPCs immediately after association. For DGA detection, a fail-open architecture ensures that if a verdict is delayed beyond 4 milliseconds, DNS queries continue resolving normally—your workloads experience no disruption.

Advanced DNS Security evaluates internet-bound DNS queries (public domains) from associated VPCs. Internal domains resolved within a VPC are not evaluated by Advanced DNS Security.

Open the Amazon VPC console.
Select DNS FirewallRule groups and select the rule group containing your Palo Alto Networks Advanced DNS Security rules.

The following steps assume you have already subscribed and created DNS Firewall rules.

For general configuration of R53 DNS firewall options, refer to the Amazon R53 documentation.
Select the Associated VPCs tab and click Associate VPC.
Select one or more VPCs to associate with the rule group.

Each VPC you associate begins receiving DNS threat protection from the Palo Alto Networks security categories defined in your rules. You can associate the same rule group with multiple VPCs in the same account.
Click Associate to confirm your selections.
Verify your Associated VPC configuration from the overview. This displays all VPCs that have been configured to access the rule.
(Optional) Share the rule group across AWS accounts.
To enforce Advanced DNS Security protections across multiple accounts, share the rule group using one of the following methods:
- AWS Resource Access Manager (RAM)—Share the rule group with specific accounts or your entire organization. Accounts that have an active Advanced DNS Security subscription can then associate the shared rule group with their VPCs.
- Route 53 Profiles—Associate the rule group with a Route 53 Profile and apply the profile to VPCs across accounts.
- AWS Firewall Manager—Centrally deploy DNS Firewall rule groups containing Palo Alto Networks rules across all accounts in your organization through Firewall Manager policies.
Verify that DNS threat protection is active.

After association, monitor DNS firewall activity through AWS CloudWatch metrics to confirm that queries are being evaluated against your Palo Alto Networks DNS security rules. You can review the number of queries blocked or alerted, the top domains matched, and the rules that triggered matches. For additional deployment guidance, see best practices.