Skip to content

Commit 9b629a4

Browse files
committed
Add AWS Route53 resources
This is a very important AWS service to gain security insights with. Signed-off-by: Tim Smith <tsmith84@gmail.com>
1 parent 779ff93 commit 9b629a4

File tree

7 files changed

+3056
-12
lines changed

7 files changed

+3056
-12
lines changed

providers/aws/connection/clients.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ import (
4646
"github.com/aws/aws-sdk-go-v2/service/organizations"
4747
"github.com/aws/aws-sdk-go-v2/service/rds"
4848
"github.com/aws/aws-sdk-go-v2/service/redshift"
49+
"github.com/aws/aws-sdk-go-v2/service/route53"
4950
"github.com/aws/aws-sdk-go-v2/service/s3"
5051
"github.com/aws/aws-sdk-go-v2/service/s3control"
5152
"github.com/aws/aws-sdk-go-v2/service/sagemaker"
@@ -807,6 +808,30 @@ func (t *AwsConnection) Redshift(region string) *redshift.Client {
807808
return client
808809
}
809810

811+
func (t *AwsConnection) Route53(region string) *route53.Client {
812+
// if no region value is sent in, use the configured region
813+
if len(region) == 0 {
814+
region = t.cfg.Region
815+
}
816+
cacheVal := "_route53_" + region
817+
818+
// check for cached client and return it if it exists
819+
c, ok := t.clientcache.Load(cacheVal)
820+
if ok {
821+
log.Debug().Msg("use cached route53 client")
822+
return c.Data.(*route53.Client)
823+
}
824+
825+
// create the client
826+
cfg := t.cfg.Copy()
827+
cfg.Region = region
828+
client := route53.NewFromConfig(cfg)
829+
830+
// cache it
831+
t.clientcache.Store(cacheVal, &CacheEntry{Data: client})
832+
return client
833+
}
834+
810835
func (t *AwsConnection) Neptune(region string) *neptune.Client {
811836
// if no region value is sent in, use the configured region
812837
if len(region) == 0 {

providers/aws/go.mod

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,17 @@ require (
4242
github.com/aws/aws-sdk-go-v2/service/iam v1.53.2
4343
github.com/aws/aws-sdk-go-v2/service/inspector2 v1.46.2
4444
github.com/aws/aws-sdk-go-v2/service/kms v1.49.5
45-
github.com/aws/aws-sdk-go-v2/service/lambda v1.87.1
45+
github.com/aws/aws-sdk-go-v2/service/lambda v1.88.0
4646
github.com/aws/aws-sdk-go-v2/service/macie2 v1.50.9
4747
github.com/aws/aws-sdk-go-v2/service/neptune v1.43.9
4848
github.com/aws/aws-sdk-go-v2/service/opensearch v1.57.1
4949
github.com/aws/aws-sdk-go-v2/service/organizations v1.50.1
5050
github.com/aws/aws-sdk-go-v2/service/rds v1.114.0
5151
github.com/aws/aws-sdk-go-v2/service/redshift v1.62.0
52-
github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1
53-
github.com/aws/aws-sdk-go-v2/service/s3control v1.67.3
54-
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.230.1
52+
github.com/aws/aws-sdk-go-v2/service/route53 v1.62.1
53+
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0
54+
github.com/aws/aws-sdk-go-v2/service/s3control v1.68.0
55+
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.231.0
5556
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.1
5657
github.com/aws/aws-sdk-go-v2/service/securityhub v1.67.3
5758
github.com/aws/aws-sdk-go-v2/service/sns v1.39.11

providers/aws/go.sum

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -243,8 +243,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 h1:bGeHBsGZx0Dvu
243243
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17/go.mod h1:dcW24lbU0CzHusTE8LLHhRLI42ejmINN8Lcr22bwh/g=
244244
github.com/aws/aws-sdk-go-v2/service/kms v1.49.5 h1:DKibav4XF66XSeaXcrn9GlWGHos6D/vJ4r7jsK7z5CE=
245245
github.com/aws/aws-sdk-go-v2/service/kms v1.49.5/go.mod h1:1SdcmEGUEQE1mrU2sIgeHtcMSxHuybhPvuEPANzIDfI=
246-
github.com/aws/aws-sdk-go-v2/service/lambda v1.87.1 h1:QBdmTXWwqVgx0PueT/Xgp2+al5HR0gAV743pTzYeBRw=
247-
github.com/aws/aws-sdk-go-v2/service/lambda v1.87.1/go.mod h1:ogjbkxFgFOjG3dYFQ8irC92gQfpfMDcy1RDKNSZWXNU=
246+
github.com/aws/aws-sdk-go-v2/service/lambda v1.88.0 h1:u66DMbJWDFXs9458RAHNtq2d0gyqcZFV4mzRwfjM358=
247+
github.com/aws/aws-sdk-go-v2/service/lambda v1.88.0/go.mod h1:ogjbkxFgFOjG3dYFQ8irC92gQfpfMDcy1RDKNSZWXNU=
248248
github.com/aws/aws-sdk-go-v2/service/macie2 v1.50.9 h1:QWspOZ3iVKM7xLMBKEFAQqj4FRMsNTFFGIDzkwBYf9E=
249249
github.com/aws/aws-sdk-go-v2/service/macie2 v1.50.9/go.mod h1:huye1S+xwe6LtT1rgzjBEsUDEPHwIwXUI9y6JYLIwFM=
250250
github.com/aws/aws-sdk-go-v2/service/neptune v1.43.9 h1:BxvsQknv8ZKdMdDVS6ofFOZGcNyKjBFxWv2CfiJ43+A=
@@ -257,12 +257,14 @@ github.com/aws/aws-sdk-go-v2/service/rds v1.114.0 h1:p9c6HDzx6sTf7uyc9xsQd693uzA
257257
github.com/aws/aws-sdk-go-v2/service/rds v1.114.0/go.mod h1:JBRYWpz5oXQtHgQC+X8LX9lh0FBCwRHJlWEIT+TTLaE=
258258
github.com/aws/aws-sdk-go-v2/service/redshift v1.62.0 h1:yvzPNFsXgoMAuu0CMkbnOhbjOA9J4ir8Bt9YgmPcCro=
259259
github.com/aws/aws-sdk-go-v2/service/redshift v1.62.0/go.mod h1:nawfGxLipdV0PTaLw4iiGGSWu7eykKZTo++EVspXNvg=
260-
github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1 h1:C2dUPSnEpy4voWFIq3JNd8gN0Y5vYGDo44eUE58a/p8=
261-
github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1/go.mod h1:5jggDlZ2CLQhwJBiZJb4vfk4f0GxWdEDruWKEJ1xOdo=
262-
github.com/aws/aws-sdk-go-v2/service/s3control v1.67.3 h1:nkSO3HDG7Vi7Cajz50vbXXJsSGaNRT0LUNQqgQQW/qU=
263-
github.com/aws/aws-sdk-go-v2/service/s3control v1.67.3/go.mod h1:wgiqMLAEVr17L0H9z57nWjg95g44NVm61jjGxEEVuxw=
264-
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.230.1 h1:Pwim9mOtB7FdgnDD3DSFdPGBcu9aCtVl3yQpCjFN7UA=
265-
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.230.1/go.mod h1:9CRmqEANAPnPXRj9r8RocG/zr5yopjf7m2bKo7Qeqyc=
260+
github.com/aws/aws-sdk-go-v2/service/route53 v1.62.1 h1:1jIdwWOulae7bBLIgB36OZ0DINACb1wxM6wdGlx4eHE=
261+
github.com/aws/aws-sdk-go-v2/service/route53 v1.62.1/go.mod h1:tE2zGlMIlxWv+7Otap7ctRp3qeKqtnja7DZguj3Vu/Y=
262+
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0 h1:oeu8VPlOre74lBA/PMhxa5vewaMIMmILM+RraSyB8KA=
263+
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0/go.mod h1:5jggDlZ2CLQhwJBiZJb4vfk4f0GxWdEDruWKEJ1xOdo=
264+
github.com/aws/aws-sdk-go-v2/service/s3control v1.68.0 h1:UX8fZnLiWEvLGcnSW7jyayNVQroVw/Z3DNHEZSgT/MM=
265+
github.com/aws/aws-sdk-go-v2/service/s3control v1.68.0/go.mod h1:wgiqMLAEVr17L0H9z57nWjg95g44NVm61jjGxEEVuxw=
266+
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.231.0 h1:lrGoI4jccQk3W+qDckN9qjMStWryboxfYKKIAIGSLz4=
267+
github.com/aws/aws-sdk-go-v2/service/sagemaker v1.231.0/go.mod h1:9CRmqEANAPnPXRj9r8RocG/zr5yopjf7m2bKo7Qeqyc=
266268
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.1 h1:72DBkm/CCuWx2LMHAXvLDkZfzopT3psfAeyZDIt1/yE=
267269
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.1/go.mod h1:A+oSJxFvzgjZWkpM0mXs3RxB5O1SD6473w3qafOC9eU=
268270
github.com/aws/aws-sdk-go-v2/service/securityhub v1.67.3 h1:FEs3IkfJWp+Sz3ZY6sAxmebBF0lr1wBcTWkuFW1OFJg=

providers/aws/resources/aws.lr

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3640,6 +3640,262 @@ private aws.redshift.cluster @defaults("dbName clusterVersion clusterStatus regi
36403640
vpcId string
36413641
}
36423642

3643+
// Amazon Route 53 DNS service
3644+
aws.route53 {
3645+
// List of all hosted zones in the account
3646+
hostedZones() []aws.route53.hostedZone
3647+
// List of all health checks in the account
3648+
healthChecks() []aws.route53.healthCheck
3649+
// List of all reusable delegation sets
3650+
delegationSets() []aws.route53.delegationSet
3651+
// List of all traffic policies
3652+
trafficPolicies() []aws.route53.trafficPolicy
3653+
// List of all query logging configurations
3654+
queryLoggingConfigs() []aws.route53.queryLoggingConfig
3655+
// List of all DNSSEC key signing keys
3656+
dnssecKeys() []aws.route53.keySigningKey
3657+
}
3658+
3659+
// Route 53 hosted zone
3660+
private aws.route53.hostedZone @defaults("id name type isPrivate") {
3661+
// Unique identifier for the hosted zone (e.g., /hostedzone/Z1234567890ABC)
3662+
id string
3663+
// Name of the domain (e.g., example.com.)
3664+
name string
3665+
// Number of resource record sets in the hosted zone
3666+
resourceRecordSetCount int
3667+
// Hosted zone type: PUBLIC or PRIVATE
3668+
type string
3669+
// Hosted zone configuration including comment and private zone settings
3670+
config dict
3671+
// Whether this is a private hosted zone
3672+
isPrivate bool
3673+
// Comment associated with the hosted zone
3674+
comment string
3675+
// List of VPCs associated with a private hosted zone
3676+
vpcs() []dict
3677+
// ARN of the hosted zone
3678+
arn string
3679+
// Tags associated with the hosted zone
3680+
tags map[string]string
3681+
// DNS resource record sets in this hosted zone
3682+
records() []aws.route53.record
3683+
// Nameservers for this hosted zone
3684+
nameServers() []string
3685+
// Query logging configuration, if enabled
3686+
queryLoggingConfig() aws.route53.queryLoggingConfig
3687+
// DNSSEC status for this zone
3688+
dnssecStatus() dict
3689+
// Key signing keys for DNSSEC
3690+
keySigningKeys() []aws.route53.keySigningKey
3691+
// Traffic policy instances applied to this zone
3692+
trafficPolicyInstances() []aws.route53.trafficPolicyInstance
3693+
}
3694+
3695+
// Route 53 DNS resource record set
3696+
private aws.route53.record @defaults("name type") {
3697+
// Hosted zone ID this record belongs to
3698+
hostedZoneId string
3699+
// Fully qualified domain name (e.g., www.example.com.)
3700+
name string
3701+
// DNS record type (A, AAAA, CNAME, MX, TXT, SOA, NS, SRV, PTR, CAA, etc.)
3702+
type string
3703+
// Time to live in seconds
3704+
ttl int
3705+
// List of resource record values (IP addresses, domain names, etc.)
3706+
resourceRecords() []string
3707+
// Alias target configuration (for AWS resource aliases)
3708+
aliasTarget() dict
3709+
// Whether this is an alias record
3710+
isAlias bool
3711+
// DNS name of the alias target (if alias record)
3712+
aliasTargetDnsName string
3713+
// Hosted zone ID of the alias target
3714+
aliasTargetHostedZoneId string
3715+
// Whether to evaluate target health for alias records
3716+
aliasEvaluateTargetHealth bool
3717+
// Routing policy identifier (for weighted, latency, failover, geolocation routing)
3718+
setIdentifier string
3719+
// Weight for weighted routing policy (0-255)
3720+
weight int
3721+
// AWS region for latency-based routing
3722+
region string
3723+
// Failover type: PRIMARY or SECONDARY
3724+
failover string
3725+
// Geographic location for geolocation routing
3726+
geoLocation() dict
3727+
// Geographic proximity routing bias
3728+
geoProximityLocation() dict
3729+
// Multi-value answer routing flag
3730+
multiValueAnswer bool
3731+
// Associated health check ID
3732+
healthCheckId string
3733+
// Health check details
3734+
healthCheck() aws.route53.healthCheck
3735+
// CIDR routing configuration
3736+
cidrRoutingConfig() dict
3737+
// Traffic policy instance ID (if managed by traffic policy)
3738+
trafficPolicyInstanceId string
3739+
}
3740+
3741+
// Route 53 health check
3742+
private aws.route53.healthCheck @defaults("id type protocol") {
3743+
// Unique identifier for the health check
3744+
id string
3745+
// ARN of the health check
3746+
arn string
3747+
// Tags associated with the health check
3748+
tags map[string]string
3749+
// Health check type: HTTP, HTTPS, TCP, CALCULATED, CLOUDWATCH_METRIC
3750+
type string
3751+
// Protocol: HTTP, HTTPS, TCP
3752+
protocol string
3753+
// IP address of the endpoint
3754+
ipAddress string
3755+
// Fully qualified domain name of the endpoint
3756+
fullyQualifiedDomainName string
3757+
// Port to check (default: 80 for HTTP, 443 for HTTPS, 80 for TCP)
3758+
port int
3759+
// Path to request for HTTP/HTTPS health checks
3760+
resourcePath string
3761+
// Search string for HTTP/HTTPS health checks
3762+
searchString string
3763+
// Request interval in seconds (10 or 30)
3764+
requestInterval int
3765+
// Number of consecutive checks before changing status (2-10)
3766+
failureThreshold int
3767+
// Whether to measure latency
3768+
measureLatency bool
3769+
// Whether to enable SNI for HTTPS checks
3770+
enableSNI bool
3771+
// Regions to check from
3772+
regions() []string
3773+
// Health check observations from different locations
3774+
status string
3775+
// For CALCULATED health checks: child health check IDs
3776+
childHealthChecks() []string
3777+
// Minimum number of healthy children required
3778+
healthThreshold int
3779+
// For CLOUDWATCH_METRIC health checks: alarm configuration
3780+
cloudWatchAlarmConfiguration() dict
3781+
// Whether the health check is inverted
3782+
inverted bool
3783+
// Whether health checks are disabled
3784+
disabled bool
3785+
// Caller reference (unique client identifier)
3786+
callerReference string
3787+
// Full configuration as dict
3788+
config dict
3789+
}
3790+
3791+
// Route 53 reusable delegation set
3792+
private aws.route53.delegationSet @defaults("id") {
3793+
// Unique identifier for the delegation set
3794+
id string
3795+
// Caller reference (unique client identifier)
3796+
callerReference string
3797+
// List of nameservers in the delegation set
3798+
nameServers() []string
3799+
}
3800+
3801+
// Route 53 traffic policy
3802+
private aws.route53.trafficPolicy @defaults("id name version") {
3803+
// Unique identifier for the traffic policy
3804+
id string
3805+
// Name of the traffic policy
3806+
name string
3807+
// Traffic policy type
3808+
type string
3809+
// Version number
3810+
version int
3811+
// Comment describing the policy
3812+
comment string
3813+
// JSON document defining the policy
3814+
document string
3815+
// Traffic policy instances using this policy
3816+
instances() []aws.route53.trafficPolicyInstance
3817+
}
3818+
3819+
// Route 53 traffic policy instance
3820+
private aws.route53.trafficPolicyInstance @defaults("id name hostedZoneId") {
3821+
// Unique identifier for the instance
3822+
id string
3823+
// Hosted zone ID where this instance is applied
3824+
hostedZoneId string
3825+
// Domain name (e.g., example.com)
3826+
name string
3827+
// Time to live
3828+
ttl int
3829+
// State: Creating or Available
3830+
state string
3831+
// Status message
3832+
message string
3833+
// Associated traffic policy ID
3834+
trafficPolicyId string
3835+
// Traffic policy version being used
3836+
trafficPolicyVersion int
3837+
// Traffic policy type
3838+
trafficPolicyType string
3839+
// Traffic policy details
3840+
trafficPolicy() aws.route53.trafficPolicy
3841+
// Hosted zone details
3842+
hostedZone() aws.route53.hostedZone
3843+
}
3844+
3845+
// Route 53 query logging configuration
3846+
private aws.route53.queryLoggingConfig @defaults("id hostedZoneId") {
3847+
// Unique identifier for the configuration
3848+
id string
3849+
// Hosted zone ID being logged
3850+
hostedZoneId string
3851+
// CloudWatch Logs log group ARN where queries are logged
3852+
cloudWatchLogsLogGroupArn string
3853+
// Associated hosted zone
3854+
hostedZone() aws.route53.hostedZone
3855+
}
3856+
3857+
// Route 53 DNSSEC key signing key
3858+
private aws.route53.keySigningKey @defaults("name status") {
3859+
// Name of the key signing key
3860+
name string
3861+
// ARN of the KMS key used for signing
3862+
kmsArn string
3863+
// Hosted zone ID
3864+
hostedZoneId string
3865+
// Flag value (always 257 for KSK)
3866+
flag int
3867+
// Signing algorithm name
3868+
signingAlgorithmMnemonic string
3869+
// Signing algorithm type
3870+
signingAlgorithmType int
3871+
// Digest algorithm name
3872+
digestAlgorithmMnemonic string
3873+
// Digest algorithm type
3874+
digestAlgorithmType int
3875+
// Key tag
3876+
keyTag int
3877+
// Digest value (base64)
3878+
digestValue string
3879+
// Public key (base64)
3880+
publicKey string
3881+
// DS record for parent zone
3882+
dsRecord string
3883+
// DNSKEY record
3884+
dnskeyRecord string
3885+
// Status: ACTIVE, INACTIVE, DELETING, ACTION_NEEDED, INTERNAL_FAILURE
3886+
status string
3887+
// Status message
3888+
statusMessage string
3889+
// Creation timestamp
3890+
createdDate time
3891+
// Last modification timestamp
3892+
lastModifiedDate time
3893+
// Associated hosted zone
3894+
hostedZone() aws.route53.hostedZone
3895+
// KMS key resource
3896+
kmsKey() aws.kms.key
3897+
}
3898+
36433899
// AWS Elastic Container Registry (ECR)
36443900
aws.ecr {
36453901
// List of private repositories

0 commit comments

Comments
 (0)