Domain Object CNAME Question

[biskit]

I have a query regarding how Domain objects handle CNAMES following trying to configure specific access for a customer system, which doesn't work when I specify the domains they've told me to allow.

I’ve done some testing in my lab.  Please also refer to the screenshot lower down.

A DNS lookup on zadarastorage-install.s3.amazonaws.com returns s3-1-w.amazonaws.com, which in turn returns s3-w.us-east-1.amazonaws.com, which in turn gives an IP address to connect to.  The IP address is different every time you refresh.

In my lab I allowed the name zadarastorage-install.s3.amazonaws.com.  The page timed out and other traffic was also dropped.

In my lab I then allowed all three names:

• zadarastorage-install.s3.amazonaws.com
• s3-1-w.amazonaws.com
• s3-w.us-east-1.amazonaws.com

The page still timed out.

In my lab I then allowed *.amazonaws.com  (i.e .amazonaws.com with the FQDN box unticked).  The page now loads immediately.

I’m not yet sure why it didn’t work when I allowed all of the names shown in the tcpdump.  But it seems quite clear that allowing a specific domain name in the rule doesn't automatically allow any CNAME's it resolves to.  I don't want to allow the whole of amazonaws.com.

Does anyone have any thoughts?  Am I doing something wrong?