← Developers
Level 0: resolver Environment
AWS
A VPC maps directly to a site. The DHCP option set assigns the Securd resolvers to every instance; the security group restricts DNS egress to those resolvers.
Configuration and reference code for AWS
Terraform
The public IP of the VPC egress (NAT gateway or instance EIP) is registered as the site IP in Securd.
main.tf
resource "aws_vpc_dhcp_options" "securd" {
domain_name_servers = [var.securd_primary, var.securd_secondary]
tags = { Name = "securd-agents" }
}
resource "aws_vpc_dhcp_options_association" "securd" {
vpc_id = aws_vpc.agents.id
dhcp_options_id = aws_vpc_dhcp_options.securd.id
}
resource "aws_security_group" "agent_egress" {
name = "agent-egress"
vpc_id = aws_vpc.agents.id
egress {
from_port = 53
to_port = 53
protocol = "udp"
cidr_blocks = ["${var.securd_primary}/32", "${var.securd_secondary}/32"]
}
egress {
from_port = 53
to_port = 53
protocol = "tcp"
cidr_blocks = ["${var.securd_primary}/32", "${var.securd_secondary}/32"]
}
egress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
Lambda and containers on Fargate
Functions and tasks in the VPC inherit the DHCP option set. Functions outside a VPC do not; give those a DoH virtual site and use the DoH page pattern.
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the recorded destinations with your team.