UpdateFirewallConfig
Updates the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).
Request Syntax
{
"FirewallFailOpen": "string
",
"ResourceId": "string
"
}
Request Parameters
For information about the parameters that are common to all actions, see Common Parameters.
The request accepts the following data in JSON format.
- FirewallFailOpen
-
Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply.
-
By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly.
-
If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them.
This behavior is only enforced for VPCs that have at least one DNS Firewall rule group association.
Type: String
Valid Values:
ENABLED | DISABLED | USE_LOCAL_RESOURCE_SETTING
Required: Yes
-
- ResourceId
-
The ID of the VPC that the configuration is for.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Required: Yes
Response Syntax
{
"FirewallConfig": {
"FirewallFailOpen": "string",
"Id": "string",
"OwnerId": "string",
"ResourceId": "string"
}
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- FirewallConfig
-
Configuration of the firewall behavior provided by DNS Firewall for a single VPC.
Type: FirewallConfig object
Errors
For information about the errors that are common to all actions, see Common Errors.
- AccessDeniedException
-
The current account doesn't have the IAM permissions required to perform the specified Resolver operation.
This error can also be thrown when a customer has reached the 5120 character limit for a resource policy for CloudWatch Logs.
HTTP Status Code: 400
- InternalServiceErrorException
-
We encountered an unknown error. Try again in a few minutes.
HTTP Status Code: 400
- ResourceNotFoundException
-
The specified resource doesn't exist.
HTTP Status Code: 400
- ThrottlingException
-
The request was throttled. Try again in a few minutes.
HTTP Status Code: 400
- ValidationException
-
You have provided an invalid command. If you ran the
UpdateFirewallDomains
request. supported values areADD
,REMOVE
, orREPLACE
a domain.HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific Amazon SDKs, see the following: