In a previous article, I outlined a ClickOps process for manually creating a DNS Firewall domain list on AWS [

Prerequisites

• Prepare the text file, compile the file containing all the domains you want to block or allow.


• Create a S3 Bucket.

Step 1 — Create the S3 Bucket and Upload the File:

Upload a file (e.g., blocked_dns_list.txt) containing the domains you want to block to the designated S3 bucket.

Step 2— Create the Lambda Function:

• Go to the Lambda Console and click “Create Function”


• Enter a Name, and choose as the Runtime “Python 3.10”


• Click on “Create Function”.
  

• At “Destinations” choose Lambda Function, and select the name of function.

Method 2: Automate with AWS CLI

For users who prefer command-line automation, AWS CLI offers an alternative:

aws route53resolver update-firewall-domains \

    --firewall-domain-list-id "rslvr-fdl-<Your_Domain_List_ID>" \

    --operation ADD \

    --domains "example1.com" "example2.com" "example3.com"

Steps:

• Replace with your Route 53 Resolver domain list ID.


• List your domains to block as arguments under the --domains parameter.


• Run the command in your CLI to quickly add or remove domains as needed.
  

Additional Tips

• 
  Automation Frequency: Consider setting a schedule to update your lists based on threat intelligence feeds.


• 
  Logging and Monitoring: Enable CloudWatch logging for Lambda functions to track updates or errors.
  

Conclusion

Automating DNS Firewall domain list updates can significantly improve your AWS environment’s security while reducing operational overhead. By following these methods, you’ll ensure that your firewall rules are up-to-date, scalable, and responsive to the latest threats.