AWS Route 53 Query Log
This page shows how to write Terraform and CloudFormation for Route 53 Query Log and write them securely.
aws_route53_query_log (Terraform)
The Query Log in Route 53 can be configured in Terraform with the resource name aws_route53_query_log. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_route53_query_log" "route53LoggingDisabled" {
cloudwatch_log_group_arn = "arn:aws:logs:us-west-1:123456789012:log-group:/route53Logging-12ABC1AB12A1:*."
zone_id = "some-route53zone-id"
resource "aws_route53_query_log" "route53_query_log" {
count = var.enable_route53_query_log ? 1 : 0
cloudwatch_log_group_arn = var.route53_query_log_cloudwatch_log_group_arn
zone_id = var.route53_query_log_zone_id != "" ? var.route53_query_log_zone_id : (var.enable_route53_zone ? element(aws_route53_zone.route53_zone.*.id, 0) : null)
resource "aws_route53_query_log" "example" {
depends_on = [aws_cloudwatch_log_resource_policy.route53-query]
cloudwatch_log_group_arn = aws_cloudwatch_log_group.example.arn
zone_id = aws_route53_zone.example.zone_id
}
resource "aws_route53_query_log" "this" {
cloudwatch_log_group_arn = var.cloudwatch_log_group_arn
zone_id = var.zone_id
}
resource "aws_route53_query_log" "dns_log_query" {
depends_on = [aws_cloudwatch_log_resource_policy.dns_log_policy]
cloudwatch_log_group_arn = aws_cloudwatch_log_group.dns_log_group.arn
zone_id = aws_route53_zone.myzone.zone_id
}
Parameters
-
cloudwatch_log_group_arnrequired - string -
idoptional computed - string -
zone_idrequired - string
Explanation in Terraform Registry
Provides a Route53 query logging configuration resource.
NOTE: There are restrictions on the configuration of query logging. Notably, the CloudWatch log group must be in the
us-east-1region, a permissive CloudWatch log resource policy must be in place, and the Route53 hosted zone must be public. See Configuring Logging for DNS Queries for additional details.
AWS::Route53::HostedZone QueryLoggingConfig (CloudFormation)
The HostedZone QueryLoggingConfig in Route53 can be configured in CloudFormation with the resource name AWS::Route53::HostedZone QueryLoggingConfig. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
CloudWatchLogsLogGroupArn
The Amazon Resource Name (ARN) of the CloudWatch Logs log group that Amazon Route 53 is publishing logs to.
Required: Yes
Type: String
Update requires: No interruption
Explanation in CloudFormation Registry
A complex type that contains information about a configuration for DNS query logging.
Frequently asked questions
What is AWS Route 53 Query Log?
AWS Route 53 Query Log is a resource for Route 53 of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Route 53 Query Log?
For Terraform, the storebot/pr_demo_flat, asrkata/SebastianUA-terraform and JamesWoolfenden/terraform-aws-dns source code examples are useful. See the Terraform Example section for further details.
