gpt4 book ai didi

python - 使用 Route 53 解析器自动记录 DNS 查询 - Cloudformation

转载 作者:行者123 更新时间:2023-12-03 07:40:32 33 4
gpt4 key购买 nike

因此,我在 AWS 中有大约 200 个账户,需要查询 VPC 流量并将其发送到集中账户上的 S3 存储桶以进行监控 - 每个账户中的所有 VPC。我们手动设置了 5 个帐户来测试该功能,并且它按我们的预期工作。我决定编写一个 yaml 并通过 CloudFormation 将脚本部署到所有其他帐户。有一个问题 - 对于 yaml 而言,AWS 对 Route53Resolver 函数的选项有限。

我可以指定 s3 目标,并且可以命名查询日志配置,但仅此而已。使查询日志有用的唯一想法是关联 VPC,但不能通过 CloudFormation 来完成。我一直在修改云的形成,因为它实际上只有 10 行代码:

Description: 
Configure DNS Resolver Query Logging with all necessary resources

Route53ResolverQuery-Config:
Type: AWS::Route53Resolver::ResolverQueryLoggingConfig
Properties:
DestinationArn: *destination*
Name: route53-dns-query-logging

它只是缺少一个添加要查询的 VPC 的选项。根据AWS文档,它不包括在内:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverqueryloggingconfigassociation.html

现在,我知道了替代方案,因为 boto3 有关联 VPC 的解决方案:

https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/route53resolver.html#Route53Resolver.Client.associate_resolver_query_log_config

因此,我可以创建配置日志,构建 lambda 函数,构建维护窗口以及运行它们所需的角色和策略,将其全部烘焙到 yaml 中,并将堆栈集部署到所有子帐户并称其为好,但是对于完全可以通过 yaml 函数中的一个可用属性来完成的事情来说,这似乎是太多的额外工作。

所以,我对你们所有人的问题是 - 我是否缺少任何东西可以简单地在单个 yaml 资源中完善此代码?还是尽可能接近它?

最佳答案

我最终利用了 Lambda 函数来实现此目的,因为我认为我可能必须这样做,但我想为任何好奇的人发布答案:

为了保密,我修改了脚本以涵盖一些信息:

Description:
Configure DNS Resolver Query Logging and create lambda and maintenance window with necessary permissions to associate VPCs with Route 53 Resolver Query Log Config.


#
# Creating variables to be used within the script to swap out necessary bucket drops
# and dependecy information for WatiCondition
#
Parameters:
CommercialMaster:
Description: The Commercial Account ID for routing.
Type: String
Default: ###########
GovCloudMaster:
Description: The GovCloud Account ID for routing.
Type: String
Default: ###########


#
# Creating conditional statements to be used within the script for necessary function
# to create the Global and Region-specific resources.
#
Conditions:
Commercial: !Equals [ !Ref AWS::Partition, 'aws' ]


Resources:
#
# Route 53 Query Logging config set up
#
Route53ResolverQueryConfig:
Type: AWS::Route53Resolver::ResolverQueryLoggingConfig
Properties:
DestinationArn: !If [ Commercial, !Sub "arn:${AWS::Partition}:s3:::route53-logs-${CommercialMaster}", !Sub "arn:${AWS::Partition}:s3:::route53-logs-${GovCloudMaster}/AWSLogs" ]
Name: route53-dns-query-logging

#
# Necessary roles and policies for Lambda function and Maintenance Window task
#
LambdaPermissionsRole:
Type: "AWS::IAM::Role"
Properties:
RoleName: LambdaR53Role
Description: Lambda permissions role for R53 association.
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: LambdaR53Policy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- logs:PutResourcePolicy
- logs:DescribeLogGroups
- route53resolver:ListResolverQueryLogConfigAssociations
- route53resolver:AssociateResolverQueryLogConfig
- logs:UpdateLogDelivery
- ec2:DescribeVpcs
- route53resolver:ListResolverQueryLogConfigs
- logs:DescribeResourcePolicies
- logs:GetLogDelivery
- logs:ListLogDeliveries
Resource: "*"

MaintenanceWindowPermissionsRole:
Type: AWS::IAM::Role
Properties:
RoleName: SSMMaintenanceTaskRole
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ssm.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: SSMMaintenanceTaskPolicy
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action: "lambda:InvokeFunction"
Resource: !Sub arn:${AWS::Partition}:lambda:*:${AWS::AccountId}:function:*

#
# Lambda function to check for new VPCs and associate them to the query log config.
#
AssociateVPCs:
Type: 'AWS::Lambda::Function'
DependsOn: WaitCondition
Properties:
Code:
ZipFile: |
import boto3
import json

def lambda_handler(event, context):
client = client_obj()
associated = associated_list(client)
response = client.list_resolver_query_log_configs(
Filters=[
{
'Name': 'Name',
'Values': [
'route53-dns-query-logging',
]
}
]
)
config = response['ResolverQueryLogConfigs'][0]['Id']
ec2 = boto3.client('ec2')
vpc = ec2.describe_vpcs()
vpcs = vpc['Vpcs']

for v in vpcs:
if v['VpcId'] not in associated:
client.associate_resolver_query_log_config(
ResolverQueryLogConfigId= f"{config}",
ResourceId=f"{v['VpcId']}"
)
print(f"{v['VpcId']} has been connected for monitoring.")
else:
print(f"{v['VpcId']} is already linked.")

def client_obj():
client = boto3.client('route53resolver')
return client

def associated_list(client_object):
associated = list()
assoc = client_object.list_resolver_query_log_config_associations()
for element in assoc['ResolverQueryLogConfigAssociations']:
associated.append(element['ResourceId'])
return associated
Description: This function associates VPCs with a DNS Query Logging Config for monitoring
FunctionName: R53-Resolver-Config-Association
Handler: index.lambda_handler
Role: !GetAtt
- LambdaPermissionsRole
- Arn
Runtime: python3.9
Timeout: 600

#
# Maintenance window and Task that triggers the Lambda function every day at 2:00am (customer requested)
#
MaintenanceWindowTrigger:
Type: AWS::SSM::MaintenanceWindow
Properties:
Name: R53-QueryVPC-Associations
AllowUnassociatedTargets: True
Description: Associate VPCs to Route53 Resolver Query Logging Config
Duration: 3
Cutoff: 1
Schedule: cron(0 0 2 ? * * *)
ScheduleTimezone: US/Eastern

MaintenanceWindowLambdaTask:
Type: AWS::SSM::MaintenanceWindowTask
Properties:
WindowId: !Ref MaintenanceWindowTrigger
TaskArn:
"Fn::GetAtt": [AssociateVPCs, Arn]
TaskType: LAMBDA
Priority: 1
Name: Daily-VPC-Association-Route53
ServiceRoleArn:
"Fn::GetAtt": [MaintenanceWindowPermissionsRole, Arn]

关于python - 使用 Route 53 解析器自动记录 DNS 查询 - Cloudformation,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/70021490/

33 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com