resolver_rules

Creates, updates, deletes, gets or lists a resolver_rules resource.

Overview

Name	resolver_rules
Type	Resource
Id	aws.route53resolver.resolver_rules

Fields

The following fields are returned by SELECT queries:

get_resolver_rule

Name	Datatype	Description
arn	string	The ARN (Amazon Resource Name) for the Resolver rule specified by Id.
creation_time	string	The date and time that the Resolver rule was created, in Unix time format and Coordinated Universal Time (UTC).
creator_request_id	string	A unique string that you specified when you created the Resolver rule. CreatorRequestId identifies the request and allows failed requests to be retried without the risk of running the operation twice.
delegation_record	string	DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.
domain_name	string	DNS queries for this domain name are forwarded to the IP addresses that are specified in TargetIps. If a query matches multiple Resolver rules (example.com and www.example.com), the query is routed using the Resolver rule that contains the most specific domain name (www.example.com).
id	string	The ID that Resolver assigned to the Resolver rule when you created it.
modification_time	string	The date and time that the Resolver rule was last updated, in Unix time format and Coordinated Universal Time (UTC).
name	string	The name for the Resolver rule, which you specified when you created the Resolver rule. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (), and spaces. The name cannot consist of only numbers. (pattern: <code>(?!^[0-9]+$)([a-zA-Z0-9-' ']+)</code>)
owner_id	string	When a rule is shared with another Amazon Web Services account, the account ID of the account that the rule is shared with.
resolver_endpoint_id	string	The ID of the endpoint that the rule is associated with.
rule_type	string	When you want to forward DNS queries for specified domain name to resolvers on your network, specify FORWARD or DELEGATE. If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com). When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify SYSTEM. For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify FORWARD for RuleType. To then have Resolver process queries for apex.example.com, you create a rule and specify SYSTEM for RuleType. Currently, only Resolver can create rules that have a value of RECURSIVE for RuleType. (FORWARD, SYSTEM, RECURSIVE, DELEGATE)
share_status	string	Whether the rule is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account. (NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME)
status	string	A code that specifies the current status of the Resolver rule. (COMPLETE, DELETING, UPDATING, FAILED)
status_message	string	A detailed description of the status of a Resolver rule.
target_ips	array	An array that contains the IP addresses and ports that an outbound endpoint forwards DNS queries to. Typically, these are the IP addresses of DNS resolvers on your network.

list_resolver_rules

Name	Datatype	Description
arn	string	The ARN (Amazon Resource Name) for the Resolver rule specified by Id.
creation_time	string	The date and time that the Resolver rule was created, in Unix time format and Coordinated Universal Time (UTC).
creator_request_id	string	A unique string that you specified when you created the Resolver rule. CreatorRequestId identifies the request and allows failed requests to be retried without the risk of running the operation twice.
delegation_record	string	DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.
domain_name	string	DNS queries for this domain name are forwarded to the IP addresses that are specified in TargetIps. If a query matches multiple Resolver rules (example.com and www.example.com), the query is routed using the Resolver rule that contains the most specific domain name (www.example.com).
id	string	The ID that Resolver assigned to the Resolver rule when you created it.
modification_time	string	The date and time that the Resolver rule was last updated, in Unix time format and Coordinated Universal Time (UTC).
name	string	The name for the Resolver rule, which you specified when you created the Resolver rule. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (), and spaces. The name cannot consist of only numbers. (pattern: <code>(?!^[0-9]+$)([a-zA-Z0-9-' ']+)</code>)
owner_id	string	When a rule is shared with another Amazon Web Services account, the account ID of the account that the rule is shared with.
resolver_endpoint_id	string	The ID of the endpoint that the rule is associated with.
rule_type	string	When you want to forward DNS queries for specified domain name to resolvers on your network, specify FORWARD or DELEGATE. If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com). When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify SYSTEM. For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify FORWARD for RuleType. To then have Resolver process queries for apex.example.com, you create a rule and specify SYSTEM for RuleType. Currently, only Resolver can create rules that have a value of RECURSIVE for RuleType. (FORWARD, SYSTEM, RECURSIVE, DELEGATE)
share_status	string	Whether the rule is shared and, if so, whether the current account is sharing the rule with another account, or another account is sharing the rule with the current account. (NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME)
status	string	A code that specifies the current status of the Resolver rule. (COMPLETE, DELETING, UPDATING, FAILED)
status_message	string	A detailed description of the status of a Resolver rule.
target_ips	array	An array that contains the IP addresses and ports that an outbound endpoint forwards DNS queries to. Typically, these are the IP addresses of DNS resolvers on your network.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_resolver_rule	select	region		Gets information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the ID of the outbound Resolver endpoint that the rule is associated with.
list_resolver_rules	select	region		Lists the Resolver rules that were created using the current Amazon Web Services account.
create_resolver_rule	insert	region, CreatorRequestId, RuleType		For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.
associate_resolver_rule	update	region, ResolverRuleId, VPCId		Associates a Resolver rule with a VPC. When you associate a rule with a VPC, Resolver forwards all DNS queries for the domain name that is specified in the rule and that originate in the VPC. The queries are forwarded to the IP addresses for the DNS resolvers that are specified in the rule. For more information about rules, see CreateResolverRule.
update_resolver_rule	update	region, ResolverRuleId, Config		Updates settings for a specified Resolver rule. ResolverRuleId is required, and all other parameters are optional. If you don't specify a parameter, it retains its current value.
delete_resolver_rule	delete	region		Deletes a Resolver rule. Before you can delete a Resolver rule, you must disassociate it from all the VPCs that you associated the Resolver rule with. For more information, see DisassociateResolverRule.
disassociate_resolver_rule	exec	region, VPCId, ResolverRuleId		Removes the association between a specified Resolver rule and a specified VPC. If you disassociate a Resolver rule from a VPC, Resolver stops forwarding DNS queries for the domain name that you specified in the Resolver rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_resolver_rule

Gets information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the ID of the outbound Resolver endpoint that the rule is associated with.

SELECT
arn,
creation_time,
creator_request_id,
delegation_record,
domain_name,
id,
modification_time,
name,
owner_id,
resolver_endpoint_id,
rule_type,
share_status,
status,
status_message,
target_ips
FROM aws.route53resolver.resolver_rules
WHERE region = '{{ region }}' -- required
;

list_resolver_rules

Lists the Resolver rules that were created using the current Amazon Web Services account.

SELECT
arn,
creation_time,
creator_request_id,
delegation_record,
domain_name,
id,
modification_time,
name,
owner_id,
resolver_endpoint_id,
rule_type,
share_status,
status,
status_message,
target_ips
FROM aws.route53resolver.resolver_rules
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_resolver_rule

For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.

INSERT INTO aws.route53resolver.resolver_rules (
CreatorRequestId,
Name,
RuleType,
DomainName,
TargetIps,
ResolverEndpointId,
Tags,
DelegationRecord,
region
)
SELECT 
'{{ CreatorRequestId }}' /* required */,
'{{ Name }}',
'{{ RuleType }}' /* required */,
'{{ DomainName }}',
'{{ TargetIps }}',
'{{ ResolverEndpointId }}',
'{{ Tags }}',
'{{ DelegationRecord }}',
'{{ region }}'
RETURNING
resolver_rule
;

Manifest

# Description fields are for documentation purposes
- name: resolver_rules
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the resolver_rules resource.
  - name: CreatorRequestId
    value: "{{ CreatorRequestId }}"
    description: |
      A unique string that identifies the request and that allows failed requests to be retried without the risk of running the operation twice. CreatorRequestId can be any unique string, for example, a date/time stamp.
  - name: Name
    value: "{{ Name }}"
    description: |
      A friendly name that lets you easily find a rule in the Resolver dashboard in the Route 53 console. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
  - name: RuleType
    value: "{{ RuleType }}"
    description: |
      When you want to forward DNS queries for specified domain name to resolvers on your network, specify FORWARD or DELEGATE. When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify SYSTEM. For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify FORWARD for RuleType. To then have Resolver process queries for apex.example.com, you create a rule and specify SYSTEM for RuleType. Currently, only Resolver can create rules that have a value of RECURSIVE for RuleType.
    valid_values: ['FORWARD', 'SYSTEM', 'RECURSIVE', 'DELEGATE']
  - name: DomainName
    value: "{{ DomainName }}"
    description: |
      DNS queries for this domain name are forwarded to the IP addresses that you specify in TargetIps. If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com).
  - name: TargetIps
    description: |
      The IPs that you want Resolver to forward DNS queries to. You can specify either Ipv4 or Ipv6 addresses but not both in the same rule. Separate IP addresses with a space. TargetIps is available only when the value of Rule type is FORWARD. You should not provide TargetIps when the Rule type is DELEGATE. when creating a DELEGATE rule, you must not provide the TargetIps parameter. If you provide the TargetIps, you may receive an ERROR message similar to "Delegate resolver rules need to specify a nameserver name". This error means you should not provide TargetIps.
    value:
      - Ip: "{{ Ip }}"
        Port: {{ Port }}
        Ipv6: "{{ Ipv6 }}"
        Protocol: "{{ Protocol }}"
        ServerNameIndication: "{{ ServerNameIndication }}"
  - name: ResolverEndpointId
    value: "{{ ResolverEndpointId }}"
    description: |
      The ID of the outbound Resolver endpoint that you want to use to route DNS queries to the IP addresses that you specify in TargetIps.
  - name: Tags
    description: |
      A list of the tag keys and values that you want to associate with the endpoint.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"
  - name: DelegationRecord
    value: "{{ DelegationRecord }}"
    description: |
      DNS queries with the delegation records that match this domain name are forwarded to the resolvers on your network.

UPDATE examples

associate_resolver_rule

Associates a Resolver rule with a VPC. When you associate a rule with a VPC, Resolver forwards all DNS queries for the domain name that is specified in the rule and that originate in the VPC. The queries are forwarded to the IP addresses for the DNS resolvers that are specified in the rule. For more information about rules, see CreateResolverRule.

UPDATE aws.route53resolver.resolver_rules
SET 
ResolverRuleId = '{{ ResolverRuleId }}',
Name = '{{ Name }}',
VPCId = '{{ VPCId }}'
WHERE 
region = '{{ region }}' --required
AND ResolverRuleId = '{{ ResolverRuleId }}' --required
AND VPCId = '{{ VPCId }}' --required
RETURNING
resolver_rule_association;

update_resolver_rule

Updates settings for a specified Resolver rule. ResolverRuleId is required, and all other parameters are optional. If you don't specify a parameter, it retains its current value.

UPDATE aws.route53resolver.resolver_rules
SET 
ResolverRuleId = '{{ ResolverRuleId }}',
Config = '{{ Config }}'
WHERE 
region = '{{ region }}' --required
AND ResolverRuleId = '{{ ResolverRuleId }}' --required
AND Config = '{{ Config }}' --required
RETURNING
resolver_rule;

DELETE examples

delete_resolver_rule

Deletes a Resolver rule. Before you can delete a Resolver rule, you must disassociate it from all the VPCs that you associated the Resolver rule with. For more information, see DisassociateResolverRule.

DELETE FROM aws.route53resolver.resolver_rules
WHERE region = '{{ region }}' --required
;

Lifecycle Methods

disassociate_resolver_rule

Removes the association between a specified Resolver rule and a specified VPC. If you disassociate a Resolver rule from a VPC, Resolver stops forwarding DNS queries for the domain name that you specified in the Resolver rule.

EXEC aws.route53resolver.resolver_rules.disassociate_resolver_rule 
@region='{{ region }}' --required 
@@json=
'{
"VPCId": "{{ VPCId }}", 
"ResolverRuleId": "{{ ResolverRuleId }}"
}'
;