Terraform AWS Provider v6.71.0 added support for AWS Network Firewall IP validation

The Terraform AWS Provider repository says support for Route 53 Resolved IP Validation shipped in v6.71.0, released October 28, 2026. AWS Network Firewall checks whether Route 53 Resolver returned a new connection’s destination IP in a VPC associated with a DNS Firewall rule group. That address check does not, by itself, identify a particular domain.

What AWS Network Firewall IP validation checks

The policy-level check runs on the first packet of a new connection. It asks whether Route 53 Resolver returned the destination IP in a VPC associated with the selected DNS Firewall rule group. A successful check means the address was resolved for some domain; it does not establish that the address belongs to the specific domain an operator wants to allow. Different domain names can share an IP address.

To match a particular domain, use a resolved-domain stateful rule, a firewall rule that tracks a connection and matches it against the domain associated with a resolved address. AWS launched Route 53 Resolved IP Validation on October 21, 2026, a week before the Terraform AWS Provider v6.71.0 release.

Set the source scope deliberately

SourceIPRanges controls which source addresses the policy validates. Leaving the field out and setting it to an empty list have different effects.

The API allows up to 100 entries in SourceIPRanges. A separate field, BypassDestinationValidationIPRanges, can exempt up to 100 destination addresses or ranges from the policy-level check. Resolved-domain stateful rules still evaluate those destinations.

A connection to a literal IP address fails policy-level validation unless that address is in the bypass ranges. A stateful Pass rule does not override a failed policy-level check, which runs before stateful rules.

Start in Alert mode before enforcing the policy

For a failed validation, AWS Network Firewall offers ALERT, DROP, and REJECT. ALERT does not block the connection; when flow logging is enabled, it tags the flow in the flow logs. DROP silently blocks it. REJECT blocks TCP traffic and sends a reset; non-TCP traffic is dropped.

For existing flows whose cached DNS resolution expires, the expiry exception can be CONTINUE, DROP, or REJECT. AWS recommends starting in alert mode, observing traffic while clients refresh cached DNS answers, and allowing about 24 hours before enforcement. This gives operators time to spot expected connections that might otherwise fail the check.

Apply resolved-domain rules to SFTP and TLS

AWS illustrates domain filtering for SFTP over TCP port 22 to files.partner.example.com. The firewall policy must have resolved-IP validation enabled for resolved-domain rules to work. The rule can match the domain even though SFTP does not carry a domain name in the connection.

AWS’s TLS example uses api.partner.example.com on port 443. A resolved-domain rule matches the destination IP. If the rule must also require the name presented in the TLS handshake, add an exact Server Name Indication (SNI) condition to that same rule.

Account for DNS paths and Availability Zones

The check covers answers from Route 53 Resolver. It does not block DNS traffic to other resolvers, including DNS over HTTPS (DoH) or DNS over TLS (DoT). AWS recommends controlling those paths when they must not bypass the check.

For a distributed deployment, each client must reach a Network Firewall endpoint in its own Availability Zone; routing a client to an endpoint in another zone causes its connections to fail this check. AWS also documents centralized deployments using a firewall natively attached to AWS Transit Gateway.

AWS says the feature has no additional charge in commercial AWS Regions where both AWS Network Firewall and Route 53 Resolver DNS Firewall are available; AWS GovCloud (US) and China Regions are excluded. A DNS Firewall rule group with no rules has no DNS Firewall charge. Adding rules incurs standard DNS Firewall pricing, and normal AWS Network Firewall and Route 53 service charges may also apply.