(aws-route53): Query Logging
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
There should be a way to enable/disable query logging on hosted zones after they are created.
Currently it appears that this is only possible when creating a hosted zone; but it should be possible to enable/disable Query Logging on an already created Hosted Zone.
### Use Case
Attempting to following the guidance provided at: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53-hostedzone.html#cfn-route53-hostedzone-queryloggingconfig
We can assume a cdk stack that looks similar to this:
```ts
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
export class InfrastructureStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Create a new HostedZone
const PublicHostedZone = new cdk.aws_route53.HostedZone(this, 'HostedZone', {
zoneName: 'example.com',
comment: 'Public Hosted Zone',
});
// Create a LogGroup for Hosted Zone Query Logs
const LogGroup = new cdk.aws_logs.LogGroup(this, 'LogGroup', {
// Do it after the HostedZone is created as we wantthe Zone ID
logGroupName: '/aws/route53/' + PublicHostedZone.hostedZoneId,
retention: cdk.aws_logs.RetentionDays.ONE_WEEK,
});
const AWSServiceRoleForRoute53 = new cdk.aws_logs.ResourcePolicy(this, 'ResourcePolicy', {
resourcePolicyName: 'AWSServiceRoleForRoute53',
policyStatements: [
new cdk.aws_iam.PolicyStatement({
sid: 'Route53LogsToCloudWatchLogs',
effect: cdk.aws_iam.Effect.ALLOW,
principals: [
new cdk.aws_iam.ServicePrincipal('route53.amazonaws.com'),
],
actions: [
'logs:CreateLogStream',
'logs:PutLogEvents',
],
resources: [
'arn:aws:logs:us-east-1:' + this.account + ':log-group:/aws/route53/*:*',
],
})
]
});
const PublicHostedZoneLoggingEnabled = new cdk.custom_resources.AwsCustomResource(this, 'create-query-logging-config', {
onCreate: {
service: 'Route53',
action: 'createQueryLoggingConfig',
physicalResourceId: { id: 'create-query-logging-config' },
parameters: {
HostedZoneId: PublicHostedZone.hostedZoneId,
CloudWatchLogsLogGroupArn: LogGroup.logGroupArn,
},
region: 'us-east-1',
},
policy: cdk.custom_resources.AwsCustomResourcePolicy.fromSdkCalls({ resources: cdk.custom_resources.AwsCustomResourcePolicy.ANY_RESOURCE })
});
}
}
```
### Proposed Solution
Something as Simple as `PublicHostedZone.enableQueryLogging(LogGroup);`
### Other Information
Possibly related to #15296 ; and possibly requires a larger RFC as a similar issue exists in CloudFormation.
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.127.0 (build 6c90efc)
### Environment details (OS name and version, etc.)
Arch Linux
Contributor guide
Research direction
Start by reviewing the AWS CloudFormation HostedZone queryloggingconfig documentation, the existing HostedZone entry point, and the AwsCustomResource createQueryLoggingConfig example in the issue. Check related issue #15296 and determine whether the CDK API can support enabling and disabling query logging on an existing hosted zone; done means the feature's design and behavior are defined for both operations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100