Customized domain name resolution for virtual private clouds

1. A system, comprising:

a domain name system (DNS) resolution service comprising one or more processors and one or more memories to store computer-executable instructions that, when executed, cause the one or more processors to:

receive a DNS request from a virtual private cloud (VPC) comprising one or more computing resources, wherein the one or more computing resources are implemented using one or more resource pools of a cloud provider network, and wherein the DNS resolution service is implemented as a service of the cloud provider network;

determine that the VPC is associated with one or more firewall rules, wherein the one or more firewall rules comprise one or more domain names and one or more actions associated with the one or more domain names;

responsive to determining that the VPC is associated with the one or more firewall rules, use a firewall instance to determine whether the DNS request is allowed or blocked according to the one or more firewall rules;

if the DNS request is allowed, resolve the DNS request using a DNS server; and

if the DNS request is blocked, return a response to the VPC without resolving the DNS request.

2. The system as recited in claim 1 , further comprising:

a rule customizer comprising an additional one or more processors and an additional one or more memories to store additional computer-executable instructions that, when executed, cause the additional one or more processors to:

determine the one or more domain names and the one or more actions of the one or more firewall rules based at least in part on input to a user interface;

determine an association between the VPC and the one or more firewall rules based at least in part on additional input to the user interface;

deploy, to the DNS resolution service via one or more networks, the association between the VPC and the one or more firewall rules; and

deploy, to the firewall instance via one or more networks, the one or more firewall rules.

3. The system as recited in claim 1 , wherein the one or more memories store additional computer-executable instructions that, when executed, cause the one or more processors to:

store an association between the one or more firewall rules and a plurality of VPCs including the VPC; and

use the one or more firewall rules to determine whether to allow or block a plurality of additional DNS requests for the plurality of VPCs.

4. The system as recited in claim 3 , wherein the plurality of VPCs are implemented in a plurality of availability zones of the cloud provider network.

5. A method, comprising:

receiving, by a domain name system (DNS) resolution service, a DNS request from a computing resource associated with a virtual private cloud (VPC) in a cloud provider network;

determining, by the DNS resolution service, that the VPC is associated with one or more firewall rules;

responsive to determining that the VPC is associated with the one or more firewall rules, determining, by the DNS resolution service, the DNS request is allowed or blocked according to the one or more firewall rules; and

resolving, by the DNS resolution service, the DNS request using a DNS server and returning a response to the DNS request to the computing resource if the DNS request is allowed; and

wherein the DNS request is not resolved by the DNS resolution service if the DNS request is blocked.

6. The method as recited in claim 5 , wherein an individual one of the one or more firewall rules comprises one or more domain names and one or more allow actions associated with individual ones of the one or more domain names.

7. The method as recited in claim 5 , wherein an individual one of the one or more firewall rules comprises one or more domain names and one or more block actions associated with individual ones of the one or more domain names.

8. The method as recited in claim 5 , wherein firewall protection is selected and the one or more firewall rules are determined based at least in part on input from an administrator of the VPC.

9. The method as recited in claim 5 , wherein determining whether the DNS request is allowed or blocked according to the one or more firewall rules is performed using a firewall instance, wherein the DNS resolution service stores an association between the VPC and the one or more firewall rules, and wherein the firewall instance stores the one or more firewall rules.

10. The method as recited in claim 9 , further comprising:

determining, using a rule customizer, one or more domain names and one or more actions of the one or more firewall rules based at least in part on input to a user interface;

determining, using the rule customizer, the association between the VPC and the one or more firewall rules based at least in part on additional input to the user interface;

deploying, from the rule customizer to the DNS resolution service via one or more networks, the association between the VPC and the one or more firewall rules; and

deploying, from the rule customizer to the firewall instance via one or more networks, the one or more firewall rules.

11. The method as recited in claim 5 , further comprising:

storing an association between the one or more firewall rules and a plurality of VPCs including the VPC; and

using the one or more firewall rules to determine whether to allow or block a plurality of additional DNS requests for the plurality of VPCs.

12. The method as recited in claim 11 , wherein the plurality of VPCs are implemented in a plurality of availability zones of the provider network.

13. The method as recited in claim 5 , wherein the DNS resolution service is implemented as a service of the cloud provider network.

14. One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:

receiving, by a domain name system (DNS) resolver, a DNS request from a virtual private cloud (VPC) comprising one or more computing resources and implemented using one or more resource pools of a multi-tenant provider network, wherein the DNS resolver is implemented using a service of the multi-tenant provider network;

determining, by the DNS resolver, that the VPC is associated with one or more firewall rules, wherein the one or more firewall rules comprise one or more domain names and one or more actions associated with the one or more domain names;

determining, by the DNS resolver based at least in part on determining that the VPC is associated with the one or more firewall rules, whether the DNS request is allowed or blocked according to the one or more firewall rules;

if the DNS request is allowed, resolving, by the DNS resolver, the DNS request using a DNS server; and

if the DNS request is blocked, returning, by the DNS resolver, a response to the DNS request without resolving the DNS request.

15. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein an individual one of the one or more firewall rules comprises one or more domain names and one or more allow actions or block actions associated with individual ones of the one or more domain names.

16. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein firewall protection is selected and the one or more firewall rules are determined based at least in part on input from an administrator of the VPC.

17. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein determining whether the DNS request is allowed or blocked according to the one or more firewall rules is performed using a firewall instance, wherein the DNS resolver stores an association between the VPC and the one or more firewall rules, and wherein the firewall instance stores the one or more firewall rules.

18. The one or more non-transitory computer-readable storage media as recited in claim 17 , further comprising additional program instructions that, when executed on or across the one or more processors, perform:

determining, using a rule customizer, one or more domain names and one or more actions of the one or more firewall rules based at least in part on input to a user interface;

determining, using the rule customizer, the association between the VPC and the one or more firewall rules based at least in part on additional input to the user interface;

deploying, from the rule customizer to the DNS resolver via one or more networks, the association between the VPC and the one or more firewall rules; and

deploying, from the rule customizer to the firewall instance via one or more networks, the one or more firewall rules.

19. The one or more non-transitory computer-readable storage media as recited in claim 14 , further comprising additional program instructions that, when executed on or across the one or more processors, perform:

storing an association between the one or more firewall rules and a plurality of VPCs including the VPC; and

using the one or more firewall rules to determine whether to allow or block a plurality of additional DNS requests for the plurality of VPCs.

20. The one or more non-transitory computer-readable storage media as recited in claim 14 , wherein the one or more firewall rules are selected from a store offering a plurality of firewall rules published by a plurality of firewall rule publishers.