feat(route53resolver-alpha): fetch managed domain list id using custom resource #27085

clueleaf · 2023-09-10T05:04:49Z

Currently you have to specify the managed domain list ID manually in order to use it in a DNS firewall rule.
This PR adds a custom resource that finds the ID from a managed domain list name, along with a new FirewallManagedDomainList class that creates the custom resource and implements IFirewallDomainList.

Closes #25614

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation · 2023-09-14T00:08:33Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

# Conflicts: # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/LambdaNodeJsLatestIntegDefaultTestDeployAssertD40B5C28.assets.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/LambdaNodeJsLatestIntegDefaultTestDeployAssertD40B5C28.template.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/.yarn-integrity # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/delay/index.d.ts # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/delay/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/delay/license # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/delay/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/node_modules/delay/readme.md # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.0b3f5699e02d713af8ae5766d9389821142c47d17818a940c2cf9b314b1f869d/yarn.lock # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.4364f9f746d12ebe3971915c6d21f444f56a624c83b24a0a0eb3ad111da37fa0.bundle/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/.yarn-integrity # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/delay/index.d.ts # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/delay/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/delay/license # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/delay/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/node_modules/delay/readme.md # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.5c2c08a7bf5b5beff386f4f0bd21f6e002dda28002148757b3d572b235414e5c/yarn.lock # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/.yarn-integrity # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/delay/index.d.ts # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/delay/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/delay/license # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/delay/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/node_modules/delay/readme.md # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/package.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.857be83e8ab6a1d9b812ae68df0a948fd5fcd6ee578ae2c7793512fdbe647611/yarn.lock # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/asset.b7c985ebfbf370ce93607a33c3851adc0b2b6a530f4c06be487e3c2ec3c06c39.bundle/index.js # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/cdk-integ-lambda-nodejs-latest.assets.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/cdk-integ-lambda-nodejs-latest.template.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/manifest.json # packages/@aws-cdk-testing/framework-integ/test/aws-lambda-nodejs/test/integ.latest.js.snapshot/tree.json # packages/@aws-cdk-testing/framework-integ/test/aws-stepfunctions/test/integ.intrinsics.js.snapshot/asset.b7c985ebfbf370ce93607a33c3851adc0b2b6a530f4c06be487e3c2ec3c06c39.bundle/index.js # packages/@aws-cdk/custom-resource-handlers/package.json # yarn.lock

lpizzinidev

Thanks (and sorry for the late review) 👍
Looks good!
Just some minor adjustments to be made in my opinion.

lpizzinidev · 2023-10-27T13:41:49Z

packages/@aws-cdk/aws-route53resolver-alpha/lib/firewall-managed-domain-list.ts

+   * and DNS tunneling to help block multiple types of threats.
+   * Includes the `AmazonGuardDutyThreatList.`


Suggested change

* and DNS tunneling to help block multiple types of threats.

* Includes the `AmazonGuardDutyThreatList.`

* and DNS tunneling to help block multiple types of threats.

*

* Includes the `AmazonGuardDutyThreatList`.

lpizzinidev · 2023-10-27T13:42:01Z

packages/@aws-cdk/aws-route53resolver-alpha/lib/firewall-managed-domain-list.ts

+   * Domains associated with Amazon GuardDuty DNS security findings.
+   * The domains are sourced from the GuardDuty's threat intelligence systems only,


Suggested change

* Domains associated with Amazon GuardDuty DNS security findings.

* The domains are sourced from the GuardDuty's threat intelligence systems only,

* Domains associated with Amazon GuardDuty DNS security findings.

*

* The domains are sourced from the GuardDuty's threat intelligence systems only,

lpizzinidev · 2023-10-27T13:43:17Z

packages/@aws-cdk/aws-route53resolver-alpha/test/firewall-managed-domain-list.test.ts

+      },
+    ],
+  });
+  Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Function', {});


Suggested change

Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Function', {});

Template.fromStack(stack).resourceCountIs('AWS::Lambda::Function', 1);

More appropriate assertion.

lpizzinidev · 2023-10-27T14:02:09Z

packages/@aws-cdk/aws-route53resolver-alpha/lib/firewall-managed-domain-list.ts

+      }],
+    });
+
+    const result = new CustomResource(this, 'GetDomainListCustomResource', {


Suggested change

const result = new CustomResource(this, 'GetDomainListCustomResource', {

const resource = new CustomResource(this, 'GetDomainListCustomResource', {

Naming.

lpizzinidev · 2023-10-27T14:02:33Z

packages/@aws-cdk/aws-route53resolver-alpha/lib/firewall-managed-domain-list.ts

+      },
+    });
+
+    this.firewallDomainListId = result.getAttString('DomainListId');


Suggested change

this.firewallDomainListId = result.getAttString('DomainListId');

this.firewallDomainListId = resource.getAttString('DomainListId');

lpizzinidev · 2023-10-27T14:18:06Z

.../custom-resource-handlers/lib/aws-route53resolver-alpha/managed-domain-list-handler/index.ts

+  switch (event.RequestType) {
+    case 'Create':
+    case 'Update':
+      const domainListName = event.ResourceProperties?.DomainListName;


Suggested change

const domainListName = event.ResourceProperties?.DomainListName;

const domainListName = event.ResourceProperties.DomainListName;

Non-optional.

lpizzinidev · 2023-10-27T14:20:42Z

.../custom-resource-handlers/lib/aws-route53resolver-alpha/managed-domain-list-handler/index.ts

+  const domainListId = domainLists.find((domainList) =>
+    domainList.ManagedOwnerName === 'Route 53 Resolver DNS Firewall'
+    && domainList.Name === domainListName,
+  )?.Id ?? undefined;


Suggested change

)?.Id ?? undefined;

)?.Id;

Redundant.

lpizzinidev · 2023-10-27T14:25:18Z

.../custom-resource-handlers/lib/aws-route53resolver-alpha/managed-domain-list-handler/index.ts

+/**
+ * Get all domain lists recursively
+ */
+async function listDomainLists(nextToken? :string): Promise<FirewallDomainListMetadata[]> {


Suggested change

async function listDomainLists(nextToken? :string): Promise<FirewallDomainListMetadata[]> {

async function listDomainLists(nextToken?: string): Promise<FirewallDomainListMetadata[]> {

lpizzinidev · 2023-10-27T14:41:14Z

...pshot/asset.b7c985ebfbf370ce93607a33c3851adc0b2b6a530f4c06be487e3c2ec3c06c39.bundle/index.js

@@ -1,3 +1,4 @@
+"use strict";


Should this file be included?

It was committed unintentionally. Reverted it.

clueleaf · 2023-10-28T06:38:51Z

@lpizzinidev Thanks for your detailed review! I think your suggestions are all applied.

lpizzinidev

Thanks 👍

aws-cdk-automation · 2023-11-10T00:21:33Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-11T00:07:50Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-12T00:08:49Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-13T00:09:02Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-14T00:08:07Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-15T00:08:13Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-16T00:08:28Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-17T00:08:22Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-11-17T16:49:39Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 9d296b5
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2023-12-08T00:08:41Z

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

aws-cdk-automation · 2023-12-09T00:08:25Z

This PR has been in the BUILD FAILING state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

aws-cdk-automation · 2023-12-17T00:09:08Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

clueleaf added 14 commits September 9, 2023 21:24

add custom resource and tests

0b673b6

add FirewallManagedDomainList class

3250edd

fix property name

26cd0b5

export enum

e65f4b2

add unit test

54a1abd

move file dir

ae537f8

update custom resource creation

6682ddb

add integ test

5dea4e2

move custom resource to constructor

d4ebb8e

move custom resource directory

d37d7cf

use integ-tests-alpha

2abdbce

update code directory path

c175808

fix

09cce5f

merge from main

2c78874

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 valued-contributor [Pilot] contributed between 6-12 PRs to the CDK labels Sep 10, 2023

aws-cdk-automation requested a review from a team September 10, 2023 05:05

aws-cdk-automation previously requested changes Sep 10, 2023

View reviewed changes

aws-cdk-automation added pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Sep 10, 2023

clueleaf added 2 commits September 10, 2023 20:35

set useCfnResponseWrapper to false

ffaa2d1

update snapshot

fddea51

aws-cdk-automation removed the pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run label Sep 10, 2023

clueleaf added 3 commits September 10, 2023 21:39

fix handler test

37fb679

add test

cb6771a

update readme

ceeb855

github-actions bot mentioned this pull request Oct 1, 2023

Monthly PRs metrics report - Sep 2023 #27368

Closed

clueleaf and others added 4 commits October 1, 2023 17:05

remove unnecessary files

861c0e9

add @resource doc tag

d5538a5

Merge branch 'main' into feat/route53resolver

ea4b833

lpizzinidev suggested changes Oct 27, 2023

View reviewed changes

clueleaf added 3 commits October 28, 2023 14:46

Merge branch 'main' into feat/route53resolver

597ea16

minor fixes

16399ac

revert unnecessary change

31d7f53

lpizzinidev approved these changes Oct 28, 2023

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Oct 28, 2023

cgarvis and others added 2 commits November 17, 2023 09:31

Merge branch 'main' into feat/route53resolver

481b312

Merge branch 'main' into feat/route53resolver

9d296b5

aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Dec 17, 2023

aws-cdk-automation closed this Dec 17, 2023

clueleaf deleted the feat/route53resolver branch January 19, 2025 10:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(route53resolver-alpha): fetch managed domain list id using custom resource #27085

feat(route53resolver-alpha): fetch managed domain list id using custom resource #27085

clueleaf commented Sep 10, 2023

aws-cdk-automation left a comment

aws-cdk-automation commented Sep 14, 2023

lpizzinidev left a comment

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

lpizzinidev Oct 27, 2023

clueleaf Oct 28, 2023

clueleaf commented Oct 28, 2023

lpizzinidev left a comment

aws-cdk-automation commented Nov 10, 2023

aws-cdk-automation commented Nov 11, 2023

aws-cdk-automation commented Nov 12, 2023

aws-cdk-automation commented Nov 13, 2023

aws-cdk-automation commented Nov 14, 2023

aws-cdk-automation commented Nov 15, 2023

aws-cdk-automation commented Nov 16, 2023

aws-cdk-automation commented Nov 17, 2023

aws-cdk-automation commented Nov 17, 2023

aws-cdk-automation commented Dec 8, 2023

aws-cdk-automation commented Dec 9, 2023

aws-cdk-automation commented Dec 17, 2023

		* and DNS tunneling to help block multiple types of threats.
		* Includes the `AmazonGuardDutyThreatList.`

		* Domains associated with Amazon GuardDuty DNS security findings.
		* The domains are sourced from the GuardDuty's threat intelligence systems only,

	Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Function', {});
	Template.fromStack(stack).resourceCountIs('AWS::Lambda::Function', 1);

	const result = new CustomResource(this, 'GetDomainListCustomResource', {
	const resource = new CustomResource(this, 'GetDomainListCustomResource', {

	this.firewallDomainListId = result.getAttString('DomainListId');
	this.firewallDomainListId = resource.getAttString('DomainListId');

	const domainListName = event.ResourceProperties?.DomainListName;
	const domainListName = event.ResourceProperties.DomainListName;

	async function listDomainLists(nextToken? :string): Promise<FirewallDomainListMetadata[]> {
	async function listDomainLists(nextToken?: string): Promise<FirewallDomainListMetadata[]> {

feat(route53resolver-alpha): fetch managed domain list id using custom resource #27085

feat(route53resolver-alpha): fetch managed domain list id using custom resource #27085

Conversation

clueleaf commented Sep 10, 2023

aws-cdk-automation left a comment

Choose a reason for hiding this comment

aws-cdk-automation commented Sep 14, 2023

lpizzinidev left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

clueleaf commented Oct 28, 2023

lpizzinidev left a comment

Choose a reason for hiding this comment

aws-cdk-automation commented Nov 10, 2023

aws-cdk-automation commented Nov 11, 2023

aws-cdk-automation commented Nov 12, 2023

aws-cdk-automation commented Nov 13, 2023

aws-cdk-automation commented Nov 14, 2023

aws-cdk-automation commented Nov 15, 2023

aws-cdk-automation commented Nov 16, 2023

aws-cdk-automation commented Nov 17, 2023

aws-cdk-automation commented Nov 17, 2023

AWS CodeBuild CI Report

aws-cdk-automation commented Dec 8, 2023

aws-cdk-automation commented Dec 9, 2023

aws-cdk-automation commented Dec 17, 2023