aws-cdk-lib.aws_route53resolver.CfnResolverEndpointProps

CfnResolverEndpointProps Struct

Properties for defining a CfnResolverEndpoint.

Source

Generated code

Type last changed

v2.254.0 · 13 May 2026

Example

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_route53resolver as route53resolver } from 'aws-cdk-lib';
const cfnResolverEndpointProps: route53resolver.CfnResolverEndpointProps = {
  direction: 'direction',
  ipAddresses: [{
    subnetId: 'subnetId',

    // the properties below are optional
    ip: 'ip',
    ipv6: 'ipv6',
  }],
  securityGroupIds: ['securityGroupIds'],

  // the properties below are optional
  dns64Enabled: false,
  ipv6InternetAccessEnabled: false,
  name: 'name',
  outpostArn: 'outpostArn',
  preferredInstanceType: 'preferredInstanceType',
  protocols: ['protocols'],
  resolverEndpointType: 'resolverEndpointType',
  rniEnhancedMetricsEnabled: false,
  tags: [{
    key: 'key',
    value: 'value',
  }],
  targetNameServerMetricsEnabled: false,
};

Properties

directionstringdirectionstrdirectionStringDirectionstringDirection*stringrequired#

Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:.

• INBOUND : allows DNS queries to your VPC from your network
• OUTBOUND : allows DNS queries from your VPC to your network
• INBOUND_DELEGATION : Resolver delegates queries to Route 53 private hosted zones from your network.

dns64Enabledboolean | IResolvabledns64_enabledtyping.Union[bool, IResolvable]dns64EnabledBooleanDns64EnabledboolDns64Enabledinterface{}#

Specifies whether DNS64 is enabled for the Inbound Resolver Endpoint.

notes

When set to true, if a DNS AAAA query is made for a domain that has only an A (IPv4) record, the resolver automatically synthesizes an AAAA (IPv6) response by embedding the IPv4 address into the well-known prefix 64:ff9b::/96. Default is false.

ipAddressesIResolvable | IResolvable | CfnResolverEndpoint.IpAddressRequestProperty[]ip_addressestyping.Union[IResolvable, typing.List[typing.Union[IResolvable, IpAddressRequestProperty]]]ipAddressesIResolvableIpAddressesIResolvableIpAddressesinterface{}required#

The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints).

The subnet ID uniquely identifies a VPC.

Even though the minimum is 1, Route 53 requires that you create at least two.

ipv6InternetAccessEnabledboolean | IResolvableipv6_internet_access_enabledtyping.Union[bool, IResolvable]ipv6InternetAccessEnabledBooleanIpv6InternetAccessEnabledboolIpv6InternetAccessEnabledinterface{}#

Specifies whether IPv6 Internet Gateway access is enabled through the Outbound Resolver Endpoint.

When set to true, this property allows your Endpoint ENIs to reach public IPv6 target nameservers through an internet gateway. Default is false.

namestringnamestrnameStringNamestringName*string#

A friendly name that lets you easily find a configuration in the Resolver dashboard in the Route 53 console.

outpostArnstringoutpost_arnstroutpostArnStringOutpostArnstringOutpostArn*string#

The ARN (Amazon Resource Name) for the Outpost.

preferredInstanceTypestringpreferred_instance_typestrpreferredInstanceTypeStringPreferredInstanceTypestringPreferredInstanceType*string#

The Amazon EC2 instance type.

protocolsstring[]protocolstyping.List[str]protocolsList<String>Protocolsstring[]Protocols*[]*string#

Protocols used for the endpoint. DoH-FIPS is applicable for a default inbound endpoints only.

notes

For an inbound endpoint you can apply the protocols as follows:

• Do53 and DoH in combination.
• Do53 and DoH-FIPS in combination.
• Do53 alone.
• DoH alone.
• DoH-FIPS alone.
• None, which is treated as Do53.

For a delegation inbound endpoint you can use Do53 only.

For an outbound endpoint you can apply the protocols as follows:

• Do53 and DoH in combination.
• Do53 alone.
• DoH alone.
• None, which is treated as Do53.

resolverEndpointTypestringresolver_endpoint_typestrresolverEndpointTypeStringResolverEndpointTypestringResolverEndpointType*string#

The Resolver endpoint IP address type.

rniEnhancedMetricsEnabledboolean | IResolvablerni_enhanced_metrics_enabledtyping.Union[bool, IResolvable]rniEnhancedMetricsEnabledBooleanRniEnhancedMetricsEnabledboolRniEnhancedMetricsEnabledinterface{}#

Indicates whether RNI enhanced metrics are enabled for the Resolver endpoint.

When enabled, one-minute granular metrics are published in CloudWatch for each RNI associated with this endpoint. When disabled, these metrics are not published.

securityGroupIdsstring[]security_group_idstyping.List[str]securityGroupIdsList<String>SecurityGroupIdsstring[]SecurityGroupIds*[]*stringrequired#

The ID of one or more security groups that control access to this VPC.

notes

The security group must include one or more inbound rules (for inbound endpoints) or outbound rules (for outbound endpoints). Inbound and outbound rules must allow TCP and UDP access. For inbound access, open port 53. For outbound access, open the port that you're using for DNS queries on your network.

tagsCfnTag[]tagstyping.List[CfnTag]tagsList<CfnTag>TagsCfnTag[]Tags*[]CfnTag#

Route 53 Resolver doesn't support updating tags through CloudFormation.

targetNameServerMetricsEnabledboolean | IResolvabletarget_name_server_metrics_enabledtyping.Union[bool, IResolvable]targetNameServerMetricsEnabledBooleanTargetNameServerMetricsEnabledboolTargetNameServerMetricsEnabledinterface{}#

Indicates whether target name server metrics are enabled for the outbound Resolver endpoint.

When enabled, one-minute granular metrics are published in CloudWatch for each target name server associated with this endpoint. When disabled, these metrics are not published. This feature is not supported for inbound Resolver endpoint.

Used as props by

• CfnResolverEndpoint