QueryLoggingConfig

Source: src/AWS/Route53/QueryLoggingConfig.ts

DNS query logging for a Route 53 public hosted zone.

Route 53 publishes query logs to a CloudWatch Logs log group in us-east-1. The log group needs a CloudWatch Logs resource policy (also in us-east-1) that allows the route53.amazonaws.com service principal to create log streams and put log events — model it with AWS.Logs.ResourcePolicy.

A hosted zone can have at most one query logging configuration, and the configuration is immutable — changing either property replaces it.

Enabling Query Logging

// Both the log group and the resource policy must live in us-east-1.
const policy = yield* Logs.ResourcePolicy("Route53QueryLogging", {
  policyName: "route53-query-logging",
  policyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "route53.amazonaws.com" },
        Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
        Resource: `arn:aws:logs:us-east-1:${accountId}:log-group:/aws/route53/*`,
      },
    ],
  },
});

const logging = yield* QueryLoggingConfig("ZoneQueryLogging", {
  hostedZoneId: zone.id,
  cloudWatchLogsLogGroupArn: logGroup.logGroupArn,
});