Amazon Route 53 Resolver Update: Add DOH protocols in resolver endpoints.

AWS · AWS · commit ba28387f4fcd · 2023-12-18T19:12:18.000Z
diff --git a/.changes/next-release/feature-AmazonRoute53Resolver-fc548c5.json b/.changes/next-release/feature-AmazonRoute53Resolver-fc548c5.json
@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Amazon Route 53 Resolver",
+    "contributor": "",
+    "description": "Add DOH protocols in resolver endpoints."
+}
diff --git a/services/route53resolver/src/main/resources/codegen-resources/endpoint-rule-set.json b/services/route53resolver/src/main/resources/codegen-resources/endpoint-rule-set.json
@@ -40,7 +40,6 @@
                     ]
                 }
             ],
-            "type": "tree",
             "rules": [
                 {
                     "conditions": [
@@ -83,7 +82,8 @@
                     },
                     "type": "endpoint"
                 }
-            ]
+            ],
+            "type": "tree"
         },
         {
             "conditions": [
@@ -96,7 +96,6 @@
                     ]
                 }
             ],
-            "type": "tree",
             "rules": [
                 {
                     "conditions": [
@@ -110,7 +109,6 @@
                             "assign": "PartitionResult"
                         }
                     ],
-                    "type": "tree",
                     "rules": [
                         {
                             "conditions": [
@@ -133,7 +131,6 @@
                                     ]
                                 }
                             ],
-                            "type": "tree",
                             "rules": [
                                 {
                                     "conditions": [
@@ -168,7 +165,6 @@
                                             ]
                                         }
                                     ],
-                                    "type": "tree",
                                     "rules": [
                                         {
                                             "conditions": [],
@@ -179,14 +175,16 @@
                                             },
                                             "type": "endpoint"
                                         }
-                                    ]
+                                    ],
+                                    "type": "tree"
                                 },
                                 {
                                     "conditions": [],
                                     "error": "FIPS and DualStack are enabled, but this partition does not support one or both",
                                     "type": "error"
                                 }
-                            ]
+                            ],
+                            "type": "tree"
                         },
                         {
                             "conditions": [
@@ -200,14 +198,12 @@
                                     ]
                                 }
                             ],
-                            "type": "tree",
                             "rules": [
                                 {
                                     "conditions": [
                                         {
                                             "fn": "booleanEquals",
                                             "argv": [
-                                                true,
                                                 {
                                                     "fn": "getAttr",
                                                     "argv": [
@@ -216,11 +212,11 @@
                                                         },
                                                         "supportsFIPS"
                                                     ]
-                                                }
+                                                },
+                                                true
                                             ]
                                         }
                                     ],
-                                    "type": "tree",
                                     "rules": [
                                         {
                                             "conditions": [
@@ -269,14 +265,16 @@
                                             },
                                             "type": "endpoint"
                                         }
-                                    ]
+                                    ],
+                                    "type": "tree"
                                 },
                                 {
                                     "conditions": [],
                                     "error": "FIPS is enabled but this partition does not support FIPS",
                                     "type": "error"
                                 }
-                            ]
+                            ],
+                            "type": "tree"
                         },
                         {
                             "conditions": [
@@ -290,7 +288,6 @@
                                     ]
                                 }
                             ],
-                            "type": "tree",
                             "rules": [
                                 {
                                     "conditions": [
@@ -310,7 +307,6 @@
                                             ]
                                         }
                                     ],
-                                    "type": "tree",
                                     "rules": [
                                         {
                                             "conditions": [],
@@ -321,14 +317,16 @@
                                             },
                                             "type": "endpoint"
                                         }
-                                    ]
+                                    ],
+                                    "type": "tree"
                                 },
                                 {
                                     "conditions": [],
                                     "error": "DualStack is enabled but this partition does not support DualStack",
                                     "type": "error"
                                 }
-                            ]
+                            ],
+                            "type": "tree"
                         },
                         {
                             "conditions": [],
@@ -339,9 +337,11 @@
                             },
                             "type": "endpoint"
                         }
-                    ]
+                    ],
+                    "type": "tree"
                 }
-            ]
+            ],
+            "type": "tree"
         },
         {
             "conditions": [],
diff --git a/services/route53resolver/src/main/resources/codegen-resources/service-2.json b/services/route53resolver/src/main/resources/codegen-resources/service-2.json
@@ -159,7 +159,7 @@
         {"shape":"ThrottlingException"},
         {"shape":"ValidationException"}
       ],
-      "documentation":"<p>Creates an Route 53 Resolver on an Outpost.</p>"
+      "documentation":"<p>Creates a Route 53 Resolver on an Outpost.</p>"
     },
     "CreateResolverEndpoint":{
       "name":"CreateResolverEndpoint",
@@ -174,6 +174,7 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"InvalidRequestException"},
         {"shape":"ResourceExistsException"},
+        {"shape":"AccessDeniedException"},
         {"shape":"LimitExceededException"},
         {"shape":"InternalServiceErrorException"},
         {"shape":"ThrottlingException"}
@@ -216,6 +217,7 @@
         {"shape":"ResourceExistsException"},
         {"shape":"ResourceUnavailableException"},
         {"shape":"InternalServiceErrorException"},
+        {"shape":"AccessDeniedException"},
         {"shape":"ThrottlingException"}
       ],
       "documentation":"<p>For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.</p>"
@@ -1186,10 +1188,11 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"InvalidParameterException"},
         {"shape":"InvalidRequestException"},
+        {"shape":"AccessDeniedException"},
         {"shape":"InternalServiceErrorException"},
         {"shape":"ThrottlingException"}
       ],
-      "documentation":"<p>Updates the name, or enpoint type for an inbound or an outbound Resolver endpoint. You can only update between IPV4 and DUALSTACK, IPV6 endpoint type can't be updated to other type. </p>"
+      "documentation":"<p>Updates the name, or endpoint type for an inbound or an outbound Resolver endpoint. You can only update between IPV4 and DUALSTACK, IPV6 endpoint type can't be updated to other type. </p>"
     },
     "UpdateResolverRule":{
       "name":"UpdateResolverRule",
@@ -1206,7 +1209,8 @@
         {"shape":"ResourceUnavailableException"},
         {"shape":"LimitExceededException"},
         {"shape":"InternalServiceErrorException"},
-        {"shape":"ThrottlingException"}
+        {"shape":"ThrottlingException"},
+        {"shape":"AccessDeniedException"}
       ],
       "documentation":"<p>Updates settings for a specified Resolver rule. <code>ResolverRuleId</code> is required, and all other parameters are optional. If you don't specify a parameter, it retains its current value.</p>"
     }
@@ -1617,7 +1621,17 @@
         },
         "IpAddresses":{
           "shape":"IpAddressesRequest",
-          "documentation":"<p>The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). The subnet ID uniquely identifies a VPC. </p>"
+          "documentation":"<p>The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). The subnet ID uniquely identifies a VPC. </p> <note> <p>Even though the minimum is 1, Route 53 requires that you create at least two.</p> </note>"
+        },
+        "OutpostArn":{
+          "shape":"OutpostArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the Outpost. If you specify this, you must also specify a value for the <code>PreferredInstanceType</code>. </p>",
+          "box":true
+        },
+        "PreferredInstanceType":{
+          "shape":"OutpostInstanceType",
+          "documentation":"<p>The instance type. If you specify this, you must also specify a value for the <code>OutpostArn</code>.</p>",
+          "box":true
         },
         "Tags":{
           "shape":"TagList",
@@ -1629,14 +1643,9 @@
           "documentation":"<p> For the endpoint type you can choose either IPv4, IPv6, or dual-stack. A dual-stack endpoint means that it will resolve via both IPv4 and IPv6. This endpoint type is applied to all IP addresses. </p>",
           "box":true
         },
-        "OutpostArn":{
-          "shape":"OutpostArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the Outpost. If you specify this, you must also specify a value for the <code>PreferredInstanceType</code>. </p>",
-          "box":true
-        },
-        "PreferredInstanceType":{
-          "shape":"OutpostInstanceType",
-          "documentation":"<p>The instance type. If you specify this, you must also specify a value for the <code>OutpostArn</code>.</p>",
+        "Protocols":{
+          "shape":"ProtocolList",
+          "documentation":"<p> The protocols you want to use for the endpoint. DoH-FIPS is applicable for inbound endpoints only. </p> <p>For an inbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 and DoH-FIPS in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>DoH-FIPS alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul> <p>For an outbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul>",
           "box":true
         }
       }
@@ -1691,8 +1700,7 @@
       "type":"structure",
       "required":[
         "CreatorRequestId",
-        "RuleType",
-        "DomainName"
+        "RuleType"
       ],
       "members":{
         "CreatorRequestId":{
@@ -1709,7 +1717,8 @@
         },
         "DomainName":{
           "shape":"DomainName",
-          "documentation":"<p>DNS queries for this domain name are forwarded to the IP addresses that you specify in <code>TargetIps</code>. If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com).</p>"
+          "documentation":"<p>DNS queries for this domain name are forwarded to the IP addresses that you specify in <code>TargetIps</code>. If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com).</p>",
+          "box":true
         },
         "TargetIps":{
           "shape":"TargetList",
@@ -2886,7 +2895,7 @@
       "type":"list",
       "member":{"shape":"IpAddressRequest"},
       "max":20,
-      "min":1
+      "min":2
     },
     "IpAddressesResponse":{
       "type":"list",
@@ -3222,7 +3231,7 @@
         },
         "ResolverDnssecConfigs":{
           "shape":"ResolverDnssecConfigList",
-          "documentation":"<p>An array that contains one <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_ResolverDnssecConfig.html\">ResolverDnssecConfig</a> element for each configuration for DNSSEC validation that is associated with the current Amazon Web Services account.</p>"
+          "documentation":"<p>An array that contains one <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_ResolverDnssecConfig.html\">ResolverDnssecConfig</a> element for each configuration for DNSSEC validation that is associated with the current Amazon Web Services account. It doesn't contain disabled DNSSEC configurations for the resource.</p>"
         }
       }
     },
@@ -3612,6 +3621,20 @@
       "min":0
     },
     "Priority":{"type":"integer"},
+    "Protocol":{
+      "type":"string",
+      "enum":[
+        "DoH",
+        "Do53",
+        "DoH-FIPS"
+      ]
+    },
+    "ProtocolList":{
+      "type":"list",
+      "member":{"shape":"Protocol"},
+      "max":2,
+      "min":1
+    },
     "PutFirewallRuleGroupPolicyRequest":{
       "type":"structure",
       "required":[
@@ -3817,17 +3840,21 @@
           "shape":"Rfc3339TimeString",
           "documentation":"<p>The date and time that the endpoint was last modified, in Unix time format and Coordinated Universal Time (UTC).</p>"
         },
-        "ResolverEndpointType":{
-          "shape":"ResolverEndpointType",
-          "documentation":"<p> The Resolver endpoint IP address type. </p>"
-        },
         "OutpostArn":{
           "shape":"OutpostArn",
           "documentation":"<p>The ARN (Amazon Resource Name) for the Outpost.</p>"
         },
         "PreferredInstanceType":{
           "shape":"OutpostInstanceType",
           "documentation":"<p> The Amazon EC2 instance type. </p>"
+        },
+        "ResolverEndpointType":{
+          "shape":"ResolverEndpointType",
+          "documentation":"<p> The Resolver endpoint IP address type. </p>"
+        },
+        "Protocols":{
+          "shape":"ProtocolList",
+          "documentation":"<p> Protocols used for the endpoint. DoH-FIPS is applicable for inbound endpoints only. </p> <p>For an inbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 and DoH-FIPS in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>DoH-FIPS alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul> <p>For an outbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul>"
         }
       },
       "documentation":"<p>In the response to a <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverEndpoint.html\">CreateResolverEndpoint</a>, <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverEndpoint.html\">DeleteResolverEndpoint</a>, <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverEndpoint.html\">GetResolverEndpoint</a>, Updates the name, or ResolverEndpointType for an endpoint, or <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverEndpoint.html\">UpdateResolverEndpoint</a> request, a complex type that contains settings for an existing inbound or outbound Resolver endpoint.</p>"
@@ -4320,6 +4347,11 @@
           "shape":"Ipv6",
           "documentation":"<p> One IPv6 address that you want to forward DNS queries to. </p>",
           "box":true
+        },
+        "Protocol":{
+          "shape":"Protocol",
+          "documentation":"<p> The protocols for the Resolver endpoints. DoH-FIPS is applicable for inbound endpoints only. </p> <p>For an inbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 and DoH-FIPS in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>DoH-FIPS alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul> <p>For an outbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul>",
+          "box":true
         }
       },
       "documentation":"<p>In a <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverRule.html\">CreateResolverRule</a> request, an array of the IPs that you want to forward DNS queries to.</p>"
@@ -4664,6 +4696,11 @@
           "shape":"UpdateIpAddresses",
           "documentation":"<p> Specifies the IPv6 address when you update the Resolver endpoint from IPv4 to dual-stack. If you don't specify an IPv6 address, one will be automatically chosen from your subnet. </p>",
           "box":true
+        },
+        "Protocols":{
+          "shape":"ProtocolList",
+          "documentation":"<p> The protocols you want to use for the endpoint. DoH-FIPS is applicable for inbound endpoints only. </p> <p>For an inbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 and DoH-FIPS in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>DoH-FIPS alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul> <p>For an outbound endpoint you can apply the protocols as follows:</p> <ul> <li> <p> Do53 and DoH in combination.</p> </li> <li> <p>Do53 alone.</p> </li> <li> <p>DoH alone.</p> </li> <li> <p>None, which is treated as Do53.</p> </li> </ul> <important> <p> You can't change the protocol of an inbound endpoint directly from only Do53 to only DoH, or DoH-FIPS. This is to prevent a sudden disruption to incoming traffic that relies on Do53. To change the protocol from Do53 to DoH, or DoH-FIPS, you must first enable both Do53 and DoH, or Do53 and DoH-FIPS, to make sure that all incoming traffic has transferred to using the DoH protocol, or DoH-FIPS, and then remove the Do53.</p> </important>",
+          "box":true
         }
       }
     },
@@ -4715,7 +4752,7 @@
       "members":{
         "Message":{"shape":"ExceptionMessage"}
       },
-      "documentation":"<p>You have provided an invalid command. Supported values are <code>ADD</code>, <code>REMOVE</code>, or <code>REPLACE</code> a domain.</p>",
+      "documentation":"<p>You have provided an invalid command. If you ran the <code>UpdateFirewallDomains</code> request. supported values are <code>ADD</code>, <code>REMOVE</code>, or <code>REPLACE</code> a domain.</p>",
       "exception":true
     }
   },

Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,6 @@`
`40`	`40`	`]`
`41`	`41`	`}`
`42`	`42`	`],`
`43`		`- "type": "tree",`
`44`	`43`	`"rules": [`
`45`	`44`	`{`
`46`	`45`	`"conditions": [`
`@@ -83,7 +82,8 @@`
`83`	`82`	`},`
`84`	`83`	`"type": "endpoint"`
`85`	`84`	`}`
`86`		`- ]`
	`85`	`+ ],`
	`86`	`+ "type": "tree"`
`87`	`87`	`},`
`88`	`88`	`{`
`89`	`89`	`"conditions": [`
`@@ -96,7 +96,6 @@`
`96`	`96`	`]`
`97`	`97`	`}`
`98`	`98`	`],`
`99`		`- "type": "tree",`
`100`	`99`	`"rules": [`
`101`	`100`	`{`
`102`	`101`	`"conditions": [`
`@@ -110,7 +109,6 @@`
`110`	`109`	`"assign": "PartitionResult"`
`111`	`110`	`}`
`112`	`111`	`],`
`113`		`- "type": "tree",`
`114`	`112`	`"rules": [`
`115`	`113`	`{`
`116`	`114`	`"conditions": [`
`@@ -133,7 +131,6 @@`
`133`	`131`	`]`
`134`	`132`	`}`
`135`	`133`	`],`
`136`		`- "type": "tree",`
`137`	`134`	`"rules": [`
`138`	`135`	`{`
`139`	`136`	`"conditions": [`
`@@ -168,7 +165,6 @@`
`168`	`165`	`]`
`169`	`166`	`}`
`170`	`167`	`],`
`171`		`- "type": "tree",`
`172`	`168`	`"rules": [`
`173`	`169`	`{`
`174`	`170`	`"conditions": [],`
`@@ -179,14 +175,16 @@`
`179`	`175`	`},`
`180`	`176`	`"type": "endpoint"`
`181`	`177`	`}`
`182`		`- ]`
	`178`	`+ ],`
	`179`	`+ "type": "tree"`
`183`	`180`	`},`
`184`	`181`	`{`
`185`	`182`	`"conditions": [],`
`186`	`183`	`"error": "FIPS and DualStack are enabled, but this partition does not support one or both",`
`187`	`184`	`"type": "error"`
`188`	`185`	`}`
`189`		`- ]`
	`186`	`+ ],`
	`187`	`+ "type": "tree"`
`190`	`188`	`},`
`191`	`189`	`{`
`192`	`190`	`"conditions": [`
`@@ -200,14 +198,12 @@`
`200`	`198`	`]`
`201`	`199`	`}`
`202`	`200`	`],`
`203`		`- "type": "tree",`
`204`	`201`	`"rules": [`
`205`	`202`	`{`
`206`	`203`	`"conditions": [`
`207`	`204`	`{`
`208`	`205`	`"fn": "booleanEquals",`
`209`	`206`	`"argv": [`
`210`		`- true,`
`211`	`207`	`{`
`212`	`208`	`"fn": "getAttr",`
`213`	`209`	`"argv": [`
`@@ -216,11 +212,11 @@`
`216`	`212`	`},`
`217`	`213`	`"supportsFIPS"`
`218`	`214`	`]`
`219`		`- }`
	`215`	`+ },`
	`216`	`+ true`
`220`	`217`	`]`
`221`	`218`	`}`
`222`	`219`	`],`
`223`		`- "type": "tree",`
`224`	`220`	`"rules": [`
`225`	`221`	`{`
`226`	`222`	`"conditions": [`
`@@ -269,14 +265,16 @@`
`269`	`265`	`},`
`270`	`266`	`"type": "endpoint"`
`271`	`267`	`}`
`272`		`- ]`
	`268`	`+ ],`
	`269`	`+ "type": "tree"`
`273`	`270`	`},`
`274`	`271`	`{`
`275`	`272`	`"conditions": [],`
`276`	`273`	`"error": "FIPS is enabled but this partition does not support FIPS",`
`277`	`274`	`"type": "error"`
`278`	`275`	`}`
`279`		`- ]`
	`276`	`+ ],`
	`277`	`+ "type": "tree"`
`280`	`278`	`},`
`281`	`279`	`{`
`282`	`280`	`"conditions": [`
`@@ -290,7 +288,6 @@`
`290`	`288`	`]`
`291`	`289`	`}`
`292`	`290`	`],`
`293`		`- "type": "tree",`
`294`	`291`	`"rules": [`
`295`	`292`	`{`
`296`	`293`	`"conditions": [`
`@@ -310,7 +307,6 @@`
`310`	`307`	`]`
`311`	`308`	`}`
`312`	`309`	`],`
`313`		`- "type": "tree",`
`314`	`310`	`"rules": [`
`315`	`311`	`{`
`316`	`312`	`"conditions": [],`
`@@ -321,14 +317,16 @@`
`321`	`317`	`},`
`322`	`318`	`"type": "endpoint"`
`323`	`319`	`}`
`324`		`- ]`
	`320`	`+ ],`
	`321`	`+ "type": "tree"`
`325`	`322`	`},`
`326`	`323`	`{`
`327`	`324`	`"conditions": [],`
`328`	`325`	`"error": "DualStack is enabled but this partition does not support DualStack",`
`329`	`326`	`"type": "error"`
`330`	`327`	`}`
`331`		`- ]`
	`328`	`+ ],`
	`329`	`+ "type": "tree"`
`332`	`330`	`},`
`333`	`331`	`{`
`334`	`332`	`"conditions": [],`
`@@ -339,9 +337,11 @@`
`339`	`337`	`},`
`340`	`338`	`"type": "endpoint"`
`341`	`339`	`}`
`342`		`- ]`
	`340`	`+ ],`
	`341`	`+ "type": "tree"`
`343`	`342`	`}`
`344`		`- ]`
	`343`	`+ ],`
	`344`	`+ "type": "tree"`
`345`	`345`	`},`
`346`	`346`	`{`
`347`	`347`	`"conditions": [],`