aws / aws/aws-cdk

(aws-route53): Query Logging

Open
#29,095 3 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-route53 effort/medium feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

There should be a way to enable/disable query logging on hosted zones after they are created.

Currently it appears that this is only possible when creating a hosted zone; but it should be possible to enable/disable Query Logging on an already created Hosted Zone.

### Use Case

Attempting to following the guidance provided at: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53-hostedzone.html#cfn-route53-hostedzone-queryloggingconfig

We can assume a cdk stack that looks similar to this:
```ts
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class InfrastructureStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

// Create a new HostedZone
const PublicHostedZone = new cdk.aws_route53.HostedZone(this, 'HostedZone', {
zoneName: 'example.com',
comment: 'Public Hosted Zone',
});

// Create a LogGroup for Hosted Zone Query Logs
const LogGroup = new cdk.aws_logs.LogGroup(this, 'LogGroup', {
// Do it after the HostedZone is created as we wantthe Zone ID
logGroupName: '/aws/route53/' + PublicHostedZone.hostedZoneId,
retention: cdk.aws_logs.RetentionDays.ONE_WEEK,
});

const AWSServiceRoleForRoute53 = new cdk.aws_logs.ResourcePolicy(this, 'ResourcePolicy', {
resourcePolicyName: 'AWSServiceRoleForRoute53',
policyStatements: [
new cdk.aws_iam.PolicyStatement({
sid: 'Route53LogsToCloudWatchLogs',
effect: cdk.aws_iam.Effect.ALLOW,
principals: [
new cdk.aws_iam.ServicePrincipal('route53.amazonaws.com'),
],
actions: [
'logs:CreateLogStream',
'logs:PutLogEvents',
],
resources: [
'arn:aws:logs:us-east-1:' + this.account + ':log-group:/aws/route53/*:*',
],
})
]
});

const PublicHostedZoneLoggingEnabled = new cdk.custom_resources.AwsCustomResource(this, 'create-query-logging-config', {
onCreate: {
service: 'Route53',
action: 'createQueryLoggingConfig',
physicalResourceId: { id: 'create-query-logging-config' },
parameters: {
HostedZoneId: PublicHostedZone.hostedZoneId,
CloudWatchLogsLogGroupArn: LogGroup.logGroupArn,
},
region: 'us-east-1',
},
policy: cdk.custom_resources.AwsCustomResourcePolicy.fromSdkCalls({ resources: cdk.custom_resources.AwsCustomResourcePolicy.ANY_RESOURCE })
});
}
}

```

### Proposed Solution

Something as Simple as `PublicHostedZone.enableQueryLogging(LogGroup);`

### Other Information

Possibly related to #15296 ; and possibly requires a larger RFC as a similar issue exists in CloudFormation.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.127.0 (build 6c90efc)

### Environment details (OS name and version, etc.)

Arch Linux

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the AWS CloudFormation HostedZone queryloggingconfig documentation, the existing HostedZone entry point, and the AwsCustomResource createQueryLoggingConfig example in the issue. Check related issue #15296 and determine whether the CDK API can support enabling and disabling query logging on an existing hosted zone; done means the feature's design and behavior are defined for both operations.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.