長久以來的洞總算有比較好的方法補上了，AWS 推出了 Amazon Route 53 Resolver DNS Firewall：「Introducing Amazon Route 53 Resolver DNS Firewall」。
Route 53 Resolver 是 AWS 官方提供的 DNS Resolver，沒有特殊的設定的話通常會在 x.x.x.2 (/24 或是更大的網段)，先前一直沒有辦法解決 data leak 的問題，也就是透過 DNS 把敏感資料從 private network 裡丟出去。
以前的作法是透過 security group 擋掉對 Route 53 Resolver 的流量 (或是透過 VPC 的 Firewall 擋)，然後自己架設兩台 DNS resolver 過濾，現在 Route 53 Resolver 支援 DNS Firewall，提供 allowlist 與 blocklist 這兩個功能使用，總算是把這件事情解的比較乾淨了：
Route 53 Resolver DNS Firewall lets you create “blocklists” for domains you don’t want your VPC resources to communicate with via DNS. You can also take a stricter, “walled-garden” approach by creating “allowlists” that permit outbound DNS queries only to domains you specify. You can also create alerts for when outbound DNS queries match certain firewall rules, allowing you to test your rules before deploying for production traffic.
另外這次的 DNS Firwall 提供了兩組由 AWS 維護的清單讓人使用，包括了 malware 與 botnet：
Route 53 Resolver DNS Firewall offers two managed domain lists—malware domains and botnet command and control domains—enabling you to get started quickly with managed protections against common threats.
這樣省事多了...