Enhancing AWS Route 53 with GuardDuty Threat Intelligence

By Gaurav Suthar / Sep 09,2023

Amazon Route 53 is a managed Domain Name System (DNS) service that ensures high availability and performance for applications. Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts for potential risks. 

This integration between Amazon Route 53 and Amazon GuardDuty allows AWS users to proactively monitor their applications against DNS threats and simplifies threat mitigation. By leveraging GuardDuty's sophisticated threat intelligence, Amazon Route 53's Resolver DNS Firewall can effectively identify and block malicious domains, fortifying cloud infrastructure with an additional layer of defense. 

This blog post covers the significance of this groundbreaking integration, highlighting its role in enhancing security and streamlining threat management within the AWS framework.

Key Features of Amazon GuardDuty 

1. Threat Intelligence Integration: GuardDuty utilizes comprehensive threat intelligence sources to identify malicious activities, compromised instances, and unauthorized access. 

2. Behavioral Analysis: The service continuously monitors user and resource behaviors to detect anomalies that may indicate unauthorized access or malicious intent. 

3. Centralized Findings: GuardDuty consolidates its findings into actionable alerts, providing you with a centralized view of potential threats across your AWS accounts. 

4. Automated Response: You can set up automated responses using AWS Lambda functions to remediate threats detected by GuardDuty. 

How to enable the Integration between Amazon Route53 and Amazon GuardDuty? 

Enabling the integration between Amazon Route 53 and Amazon GuardDuty is a simple process that can be accomplished through the AWS Management Console. Follow these step-by-step instructions to enable the integration and add an extra layer of security to your AWS environment: 

Prerequisites 

Ensure that you have the necessary permissions to make changes to Amazon Route 53 and Amazon GuardDuty settings. 

• Step 1: Log in to AWS Management Console.
  Go to the AWS Management Console website.
  Sign into your AWS account.
• Step 2: Access Amazon Route 53 Resolver DNS Firewall.
  In the search bar, type Route 53 and press Enter.
  The Amazon Route 53 console will open.
  In the Route 53 dashboard, locate and select Resolver.
  It redirects you to the Amazon Route 53 Resolver DNS Firewall section.

  

• Step 3: Create a New Rule Group.
  In the Amazon Route 53 Resolver DNS Firewall section, click on Add rule group.
  From the list of the existing rules group, create a rule group.

  

• Step 4: Select AWSManagedDomainAmazonGuardDutyThreatList.
  To configure the new Rule group list, select the AWSManagedDomainAmazonGuardDutyThreatList option.
  This rule group ensures that the list includes domains that are known or suspected to be malicious based on the threat intelligence provided by Amazon GuardDuty.

  

  Select Add AWS managed Domain option and provide BLOCK for the action input.

  

  

• Step 5: Click Create.
  After completing the above steps, click Create to finalize the creation of the new list.

  

• Step 6: Activation and Enforcement.
  After creating the rule group, Amazon Route 53 Resolver DNS Firewall will automatically initiate the blocking of DNS queries to domains identified as low-reputation or malicious, based on Amazon GuardDuty's threat intelligence.

Remember: Attach the Rule group to the specific VPC you want to protect.

Congratulations! You have successfully enabled the integration between Amazon Route 53 and Amazon GuardDuty. Your AWS environment now boasts an additional layer of security, safeguarding your applications from potential DNS-based threats. 

The following screenshot shows an EC2 instance launched within a VPC that is protected by the GuardDuty Threat list rule group. If the instance is configured correctly, it will be prevented from accessing domains that are blocked by the rule group. As shown in the screenshot, the system is working as expected.

Conclusion 

With the integration of Amazon Route 53 and Amazon GuardDuty, AWS users now have a more powerful toolset to protect their applications and resources from DNS-based threats. This seamless integration allows you to leverage GuardDuty's threat intelligence to automatically block malicious domains, providing increased security, reduced operational workload, and improved visibility into potential threats. 

If you're using Amazon Route 53 and Amazon GuardDuty, we highly encourage you to enable this integration to add an additional layer of security to your AWS environment. By doing so, you can enhance the protection of your applications and resources, safeguarding your AWS accounts from potential security risks.