UpdateFirewallConfig - Amazon Route 53
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Updates the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).

Request Syntax

{ "FirewallFailOpen": "string", "ResourceId": "string" }

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.


Determines how Route 53 Resolver handles queries during failures, for example when all traffic that is sent to DNS Firewall fails to receive a reply.

  • By default, fail open is disabled, which means the failure mode is closed. This approach favors security over availability. DNS Firewall blocks queries that it is unable to evaluate properly.

  • If you enable this option, the failure mode is open. This approach favors availability over security. DNS Firewall allows queries to proceed if it is unable to properly evaluate them.

This behavior is only enforced for VPCs that have at least one DNS Firewall rule group association.

Type: String


Required: Yes


The ID of the VPC that the configuration is for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 64.

Required: Yes

Response Syntax

{ "FirewallConfig": { "FirewallFailOpen": "string", "Id": "string", "OwnerId": "string", "ResourceId": "string" } }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


Configuration of the firewall behavior provided by DNS Firewall for a single VPC.

Type: FirewallConfig object


For information about the errors that are common to all actions, see Common Errors.


The current account doesn't have the IAM permissions required to perform the specified Resolver operation.

This error can also be thrown when a customer has reached the 5120 character limit for a resource policy for CloudWatch Logs.

HTTP Status Code: 400


We encountered an unknown error. Try again in a few minutes.

HTTP Status Code: 400


The specified resource doesn't exist.

HTTP Status Code: 400


The request was throttled. Try again in a few minutes.

HTTP Status Code: 400


You have provided an invalid command. If you ran the UpdateFirewallDomains request. supported values are ADD, REMOVE, or REPLACE a domain.

HTTP Status Code: 400

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: