使用 Route 53 解析器自动记录 DNS 查询 - Cloudformation

Question

因此，我在 AWS 中有大约 200 个账户需要查询 VPC 流量并将其发送到集中账户上的 S3 存储桶以进行监控 - 每个账户中的所有 VPC。我们手动设置了 5 个帐户来测试该功能，它按我们预期的那样工作。我决定编写一个 yaml 并通过 CloudFormation 将脚本部署到所有其他帐户。有一个问题 - AWS 对涉及 yaml 的 Route53Resolver 函数的选项有限。

我可以分配 s3 目的地，我可以命名查询日志配置，仅此而已。使查询日志有用的唯一想法是关联 VPC，无法通过 CloudFormation 完成。我一直在修补云的形成，因为它真的只有 10 行代码：

Description: 
  Configure DNS Resolver Query Logging with all necessary resources

  Route53ResolverQuery-Config:
    Type: AWS::Route53Resolver::ResolverQueryLoggingConfig
    Properties: 
      DestinationArn: *destination*
      Name: route53-dns-query-logging

它只是缺少一个选项来添加要查询的 VPC。根据 AWS 文档，它不包括在内：

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverqueryloggingconfigassociation.html

现在，我知道了替代方案，因为 boto3 有关联 VPC 的解决方案：

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/route53resolver.html#Route53Resolver.Client.associate_resolver_query_log_config

因此，我可以创建配置日志，构建 lambda 函数，构建维护 window 以及运行它们的必要角色和策略，将其全部烘焙到 yaml 中并部署所有子帐户的堆栈集并称其为好，但对于一些完全可以用 yaml 函数中的属性可用属性完成的事情来说，这似乎是太多的额外工作。

所以，我想问大家的问题是 - 是否有任何我遗漏的东西可以简单地在一个 yaml 资源中完善这段代码？还是尽可能接近？

Answer 1

我最终为此利用了一个 Lambda 函数，因为我认为我可能不得不这样做，但我想 post 为任何好奇的人提供答案：

出于保密考虑，我对剧本进行了润色：

Description:
  Configure DNS Resolver Query Logging and create lambda and maintenance window with necessary permissions to associate VPCs with Route 53 Resolver Query Log Config.


#
#    Creating variables to be used within the script to swap out necessary bucket drops
#    and dependecy information for WatiCondition
#
Parameters:
  CommercialMaster:
    Description: The Commercial Account ID for routing.
    Type: String
    Default: ###########
  GovCloudMaster:
    Description: The GovCloud Account ID for routing.
    Type: String
    Default: ###########


#
#    Creating conditional statements to be used within the script for necessary function
#    to create the Global and Region-specific resources.
#
Conditions:
  Commercial: !Equals [ !Ref AWS::Partition, 'aws' ]
 

Resources:
#
#    Route 53 Query Logging config set up
#
  Route53ResolverQueryConfig:
    Type: AWS::Route53Resolver::ResolverQueryLoggingConfig
    Properties:
      DestinationArn: !If [ Commercial, !Sub "arn:${AWS::Partition}:s3:::route53-logs-${CommercialMaster}", !Sub "arn:${AWS::Partition}:s3:::route53-logs-${GovCloudMaster}/AWSLogs" ]
      Name: route53-dns-query-logging
 
#
#    Necessary roles and policies for Lambda function and Maintenance Window task
#
  LambdaPermissionsRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: LambdaR53Role
      Description:  Lambda permissions role for R53 association.
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LambdaR53Policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:PutResourcePolicy
                  - logs:DescribeLogGroups
                  - route53resolver:ListResolverQueryLogConfigAssociations
                  - route53resolver:AssociateResolverQueryLogConfig
                  - logs:UpdateLogDelivery
                  - ec2:DescribeVpcs
                  - route53resolver:ListResolverQueryLogConfigs
                  - logs:DescribeResourcePolicies
                  - logs:GetLogDelivery
                  - logs:ListLogDeliveries
                Resource: "*"
 
  MaintenanceWindowPermissionsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SSMMaintenanceTaskRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /  
      Policies:
        - PolicyName: SSMMaintenanceTaskPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action: "lambda:InvokeFunction"
                Resource: !Sub arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:*
 
#
#    Lambda function to check for new VPCs and associate them to the query log config.
#
  AssociateVPCs:
    Type: 'AWS::Lambda::Function'
    DependsOn: WaitCondition
    Properties:
      Code:
        ZipFile: |
            import boto3
            import json
 
            def lambda_handler(event, context):
                client = client_obj()
                associated = associated_list(client)
                response = client.list_resolver_query_log_configs(
                    Filters=[
                        {
                            'Name': 'Name',
                            'Values': [
                                'route53-dns-query-logging',
                            ]
                        }
                    ]
                )
                config = response['ResolverQueryLogConfigs'][0]['Id']
                ec2 = boto3.client('ec2')
                vpc = ec2.describe_vpcs()
                vpcs = vpc['Vpcs']
 
                for v in vpcs:
                    if v['VpcId'] not in associated:
                        client.associate_resolver_query_log_config(
                            ResolverQueryLogConfigId= f"{config}",
                            ResourceId=f"{v['VpcId']}"
                        )
                        print(f"{v['VpcId']} has been connected for monitoring.")
                    else:
                        print(f"{v['VpcId']} is already linked.")
 
            def client_obj():
                client = boto3.client('route53resolver')
                return client
 
            def associated_list(client_object):
                associated = list()
                assoc = client_object.list_resolver_query_log_config_associations()
                for element in assoc['ResolverQueryLogConfigAssociations']:
                    associated.append(element['ResourceId'])
                return associated
      Description: This function associates VPCs with a DNS Query Logging Config for monitoring
      FunctionName: R53-Resolver-Config-Association
      Handler: index.lambda_handler
      Role: !GetAtt
        - LambdaPermissionsRole
        - Arn
      Runtime: python3.9
      Timeout: 600
 
#
#    Maintenance window and Task that triggers the Lambda function every day at 2:00am (customer requested)
#
  MaintenanceWindowTrigger:
    Type: AWS::SSM::MaintenanceWindow
    Properties:
      Name: R53-QueryVPC-Associations
      AllowUnassociatedTargets: True
      Description: Associate VPCs to Route53 Resolver Query Logging Config
      Duration: 3
      Cutoff: 1
      Schedule: cron(0 0 2 ? * * *)
      ScheduleTimezone: US/Eastern
 
  MaintenanceWindowLambdaTask:
    Type: AWS::SSM::MaintenanceWindowTask
    Properties:
      WindowId: !Ref MaintenanceWindowTrigger
      TaskArn:
        "Fn::GetAtt": [AssociateVPCs, Arn]
      TaskType: LAMBDA
      Priority: 1
      Name: Daily-VPC-Association-Route53
      ServiceRoleArn:
        "Fn::GetAtt": [MaintenanceWindowPermissionsRole, Arn]

使用 Route 53 解析器自动记录 DNS 查询 - Cloudformation

Automate DNS Query Logging with Route53 Resolver - Cloud Formation

python

dns

amazon-web-services

amazon-cloudformation

amazon-route53