api_op_CreateQueryLoggingConfig.go (9772B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package route53 4 5 import ( 6 "context" 7 8 "github.com/aws/aws-sdk-go-v2/service/route53/types" 9 "github.com/aws/smithy-go/middleware" 10 ) 11 12 // Creates a configuration for DNS query logging. After you create a query logging 13 // configuration, Amazon Route 53 begins to publish log data to an Amazon 14 // CloudWatch Logs log group. 15 // 16 // DNS query logs contain information about the queries that Route 53 receives for 17 // a specified public hosted zone, such as the following: 18 // 19 // - Route 53 edge location that responded to the DNS query 20 // 21 // - Domain or subdomain that was requested 22 // 23 // - DNS record type, such as A or AAAA 24 // 25 // - DNS response code, such as NoError or ServFail 26 // 27 // Log Group and Resource Policy Before you create a query logging configuration, 28 // perform the following operations. 29 // 30 // If you create a query logging configuration using the Route 53 console, Route 31 // 53 performs these operations automatically. 32 // 33 // - Create a CloudWatch Logs log group, and make note of the ARN, which you 34 // specify when you create a query logging configuration. Note the following: 35 // 36 // - You must create the log group in the us-east-1 region. 37 // 38 // - You must use the same Amazon Web Services account to create the log group 39 // and the hosted zone that you want to configure query logging for. 40 // 41 // - When you create log groups for query logging, we recommend that you use a 42 // consistent prefix, for example: 43 // 44 // /aws/route53/hosted zone name 45 // 46 // In the next step, you'll create a resource policy, which controls access to one 47 // 48 // or more log groups and the associated Amazon Web Services resources, such as 49 // Route 53 hosted zones. There's a limit on the number of resource policies that 50 // you can create, so we recommend that you use a consistent prefix so you can use 51 // the same resource policy for all the log groups that you create for query 52 // logging. 53 // 54 // - Create a CloudWatch Logs resource policy, and give it the permissions that 55 // Route 53 needs to create log streams and to send query logs to log streams. You 56 // must create the CloudWatch Logs resource policy in the us-east-1 region. For the 57 // value of Resource , specify the ARN for the log group that you created in the 58 // previous step. To use the same resource policy for all the CloudWatch Logs log 59 // groups that you created for query logging configurations, replace the hosted 60 // zone name with * , for example: 61 // 62 // arn:aws:logs:us-east-1:123412341234:log-group:/aws/route53/* 63 // 64 // To avoid the confused deputy problem, a security issue where an entity without 65 // 66 // a permission for an action can coerce a more-privileged entity to perform it, 67 // you can optionally limit the permissions that a service has to a resource in a 68 // resource-based policy by supplying the following values: 69 // 70 // - For aws:SourceArn , supply the hosted zone ARN used in creating the query 71 // logging configuration. For example, aws:SourceArn: 72 // arn:aws:route53:::hostedzone/hosted zone ID . 73 // 74 // - For aws:SourceAccount , supply the account ID for the account that creates 75 // the query logging configuration. For example, aws:SourceAccount:111111111111 . 76 // 77 // For more information, see [The confused deputy problem]in the Amazon Web Services IAM User Guide. 78 // 79 // You can't use the CloudWatch console to create or edit a resource policy. You 80 // 81 // must use the CloudWatch API, one of the Amazon Web Services SDKs, or the CLI. 82 // 83 // Log Streams and Edge Locations When Route 53 finishes creating the 84 // configuration for DNS query logging, it does the following: 85 // 86 // - Creates a log stream for an edge location the first time that the edge 87 // location responds to DNS queries for the specified hosted zone. That log stream 88 // is used to log all queries that Route 53 responds to for that edge location. 89 // 90 // - Begins to send query logs to the applicable log stream. 91 // 92 // The name of each log stream is in the following format: 93 // 94 // hosted zone ID/edge location code 95 // 96 // The edge location code is a three-letter code and an arbitrarily assigned 97 // number, for example, DFW3. The three-letter code typically corresponds with the 98 // International Air Transport Association airport code for an airport near the 99 // edge location. (These abbreviations might change in the future.) For a list of 100 // edge locations, see "The Route 53 Global Network" on the [Route 53 Product Details]page. 101 // 102 // Queries That Are Logged Query logs contain only the queries that DNS resolvers 103 // forward to Route 53. If a DNS resolver has already cached the response to a 104 // query (such as the IP address for a load balancer for example.com), the resolver 105 // will continue to return the cached response. It doesn't forward another query to 106 // Route 53 until the TTL for the corresponding resource record set expires. 107 // Depending on how many DNS queries are submitted for a resource record set, and 108 // depending on the TTL for that resource record set, query logs might contain 109 // information about only one query out of every several thousand queries that are 110 // submitted to DNS. For more information about how DNS works, see [Routing Internet Traffic to Your Website or Web Application]in the Amazon 111 // Route 53 Developer Guide. 112 // 113 // Log File Format For a list of the values in each query log and the format of 114 // each value, see [Logging DNS Queries]in the Amazon Route 53 Developer Guide. 115 // 116 // Pricing For information about charges for query logs, see [Amazon CloudWatch Pricing]. 117 // 118 // How to Stop Logging If you want Route 53 to stop sending query logs to 119 // CloudWatch Logs, delete the query logging configuration. For more information, 120 // see [DeleteQueryLoggingConfig]. 121 // 122 // [The confused deputy problem]: https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html 123 // [DeleteQueryLoggingConfig]: https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteQueryLoggingConfig.html 124 // [Routing Internet Traffic to Your Website or Web Application]: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/welcome-dns-service.html 125 // [Route 53 Product Details]: http://aws.amazon.com/route53/details/ 126 // [Amazon CloudWatch Pricing]: http://aws.amazon.com/cloudwatch/pricing/ 127 // [Logging DNS Queries]: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html 128 func (c *Client) CreateQueryLoggingConfig(ctx context.Context, params *CreateQueryLoggingConfigInput, optFns ...func(*Options)) (*CreateQueryLoggingConfigOutput, error) { 129 if params == nil { 130 params = &CreateQueryLoggingConfigInput{} 131 } 132 133 result, metadata, err := c.invokeOperation(ctx, "CreateQueryLoggingConfig", params, optFns, c.addOperationCreateQueryLoggingConfigMiddlewares) 134 if err != nil { 135 return nil, err 136 } 137 138 out := result.(*CreateQueryLoggingConfigOutput) 139 out.ResultMetadata = metadata 140 return out, nil 141 } 142 143 type CreateQueryLoggingConfigInput struct { 144 145 // The Amazon Resource Name (ARN) for the log group that you want to Amazon Route 146 // 53 to send query logs to. This is the format of the ARN: 147 // 148 // arn:aws:logs:region:account-id:log-group:log_group_name 149 // 150 // To get the ARN for a log group, you can use the CloudWatch console, the [DescribeLogGroups] API 151 // action, the [describe-log-groups]command, or the applicable command in one of the Amazon Web 152 // Services SDKs. 153 // 154 // [describe-log-groups]: https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html 155 // [DescribeLogGroups]: https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html 156 // 157 // This member is required. 158 CloudWatchLogsLogGroupArn *string 159 160 // The ID of the hosted zone that you want to log queries for. You can log queries 161 // only for public hosted zones. 162 // 163 // This member is required. 164 HostedZoneId *string 165 166 noSmithyDocumentSerde 167 } 168 169 type CreateQueryLoggingConfigOutput struct { 170 171 // The unique URL representing the new query logging configuration. 172 // 173 // This member is required. 174 Location *string 175 176 // A complex type that contains the ID for a query logging configuration, the ID 177 // of the hosted zone that you want to log queries for, and the ARN for the log 178 // group that you want Amazon Route 53 to send query logs to. 179 // 180 // This member is required. 181 QueryLoggingConfig *types.QueryLoggingConfig 182 183 // Metadata pertaining to the operation's result. 184 ResultMetadata middleware.Metadata 185 186 noSmithyDocumentSerde 187 } 188 189 func (c *Client) addOperationCreateQueryLoggingConfigMiddlewares(stack *middleware.Stack, options Options) (err error) { 190 err = stack.Serialize.Add(&awsRestxml_serializeOpCreateQueryLoggingConfig{}, middleware.After) 191 if err != nil { 192 return err 193 } 194 err = stack.Deserialize.Add(&awsRestxml_deserializeOpCreateQueryLoggingConfig{}, middleware.After) 195 if err != nil { 196 return err 197 } 198 199 if err = addComputeContentLength(stack); err != nil { 200 return err 201 } 202 if err = addResolveEndpointMiddleware(stack, options); err != nil { 203 return err 204 } 205 if err = addComputePayloadSHA256(stack); err != nil { 206 return err 207 } 208 if err = addRecordResponseTiming(stack, options); err != nil { 209 return err 210 } 211 if err = addCredentialSource(stack, options); err != nil { 212 return err 213 } 214 if err = addOpCreateQueryLoggingConfigValidationMiddleware(stack); err != nil { 215 return err 216 } 217 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 218 return err 219 } 220 if err = addResponseErrorMiddleware(stack); err != nil { 221 return err 222 } 223 if err = addSanitizeURLMiddleware(stack); err != nil { 224 return err 225 } 226 if err = addRequestResponseLogging(stack, options); err != nil { 227 return err 228 } 229 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 230 return err 231 } 232 if err = addInterceptors(stack, options); err != nil { 233 return err 234 } 235 return nil 236 }