Lecture 221: Route 53 Logging
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:15
- 来源：Udemy Lecture 33170768
- Slide 数量：4
- 画面切换：00:55、01:38、01:50
扫描说明
逐条读取了 Udemy 页面中的 46 条英文 Transcript cue，并按时间轴扫描全长约 02:15 的视频。依据 Public DNS Query Logging、VPC Resolver Query Logging、AWS RAM 共享、JSON Log Fields 划分为 4 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. DNS Query Logging 记录 Public Hosted Zone 收到的公共 Query
时间范围：00:00–00:55
总结 / Summary
中文
DNS Query Logging 只适用于 Public Hosted Zone，记录 Route 53 权威 Name Server 收到的公共 DNS Query，并直接写入 CloudWatch Logs，之后可再 Export 到 S3。字段包含 Log Format Version、Timestamp、Hosted Zone ID、Query Name/Type、Response Code、Protocol、Edge Location、Resolver IP 与 EDNS Client Subnet，适合审计公共权威查询。
English
DNS query logging applies only to public hosted zones. It records public queries received by Route 53 authoritative name servers and sends them directly to CloudWatch Logs, from which they can be exported to S3. Fields include log-format version, timestamp, hosted-zone ID, query name and type, response code, protocol, edge location, resolver IP, and EDNS client subnet.
Transcript
00:00 So for security and logging purposes,
00:02 it is possible to log the DNS queries made to Route 53.
00:07 So the DNS query logging is going to be a feature
00:10 to log information about all the public DNS queries
00:14 that your Route 53 Resolver receives.
00:17 So this is only applicable to the public hosted zones.
00:20 And these can be sent to CloudWatch Logs, for example,
00:23 and then from CloudWatch Logs,
00:24 you can export them into Amazon S3.
00:27 So this is what would happen in your CloudWatch log,
00:30 and we have the log format version,
00:32 we'll have the timestamp,
00:33 we'll have the hosted zone ID that received this query,
00:37 the query name, then the query type, the response code,
00:41 the protocol, the edge location, the Resolver IP address,
00:46 and the EDNS client subnets.
00:49 So this is the DNS query logging feature
00:51 for public hosted zone,
00:52 and they go directly into CloudWatch Logs.
2. Resolver Query Logging 记录 VPC Resource 发起的 Private/Hybrid Query
时间范围：00:55–01:38
总结 / Summary
中文
Resolver Query Logging 面向 VPC 内 Resource 发出的 Query，覆盖 Private Hosted Zone、Resolver Inbound/Outbound Endpoint 与 Resolver DNS Firewall 流量。示例 EC2 的 example.com Query 先进入 Route 53 Resolver，再由 Logging Configuration 捕获。Destination 可直接选择 S3 Bucket、CloudWatch Logs 或 Kinesis Data Firehose，比 Public DNS Query Logging 的输出选项更广。
English
Resolver query logging captures queries made by resources inside a VPC, including traffic involving private hosted zones, inbound and outbound resolver endpoints, and Resolver DNS Firewall. An EC2 query enters Route 53 Resolver and is captured by the logging configuration. Destinations can be an S3 bucket, CloudWatch Logs, or Kinesis Data Firehose.
Transcript
00:55 Now, the second kind we have is the Resolver query logging.
01:00 So this is to log all DNS queries
01:02 made by resources within your VPC.
01:06 So we have private hosted zones,
01:08 or the Resolver inbound and outbound endpoints,
01:11 or the Resolver DNS Firewall.
01:14 So a second example,
01:15 we have an EC2 instance within a VPC.
01:18 It's going to send an example.com query
01:20 into your Route 53 Resolver.
01:24 Then thanks to the Resolver query logging, okay?
01:27 So this is for private resources,
01:29 then is going to be sent to either your S3 buckets
01:33 or CloudWatch Logs, or even Kinesis Data Firehose.
3. Resolver Logging Configuration 可通过 AWS RAM 跨 Account 共享
时间范围：01:38–01:50
总结 / Summary
中文
Resolver Query Logging Configuration 可以通过 AWS Resource Access Manager（RAM）共享给其他 AWS Account。组织可在 Central Network/Security Account 统一定义 Destination 与 Logging Policy，再让多个 Member Account/VPC 关联同一配置，从而集中收集 Private DNS Telemetry，减少每个 Account 重复配置。
English
A Resolver query logging configuration can be shared with other AWS accounts through AWS Resource Access Manager (RAM). An organization can define destinations and logging policy in a central network or security account, associate multiple member-account VPCs, and collect private DNS telemetry without duplicating configuration in every account.
Transcript
01:38 Remember this?
01:39 And then, this configuration can be shared
01:42 with other AWS accounts using, again,
01:45 the AWS Resource Access Manager service,
01:48 or the RAM, AWS RAM service.
4. Resolver Log 使用 JSON，包含 Source、Answer、Firewall 与 Query Metadata
时间范围：01:50–02:15
总结 / Summary
中文
Resolver Query Log 采用 JSON Document，示例字段包括 Source Address/Port、VPC ID、Answer RData/Type/Class、DNS Firewall Rule Group/Action/Domain List、Query Name/Class/Type、Source Resource ID、RCode、Transport、Version、Account ID、Timestamp 与 Region。区别记忆：Public DNS Query Logging 观察权威公共 Zone；Resolver Query Logging 观察 VPC 内递归解析活动。
English
Resolver query logs are JSON documents. Example fields include source address and port, VPC ID, answer data, type and class, DNS Firewall rule group and action, query name, source resource ID, response code, transport, version, account ID, timestamp, and Region. Public DNS query logging observes authoritative public zones; Resolver query logging observes recursive activity originating in VPCs.
Transcript
01:50 What is logged within a Resolver query logging?
01:54 Well, this is a JSON document that looks like this,
01:57 which again, contains a lot of queries and inserts,
02:01 versions, account IDs, and so on, okay?
02:03 So let's say for this lecture
02:04 now you know the two ways Route 53 can do logging,
02:08 either using DNS query logging or Resolver query logging.
02:12 I hope you liked it and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Route 53 有两种主要日志：DNS Query Logging 仅记录 Public Hosted Zone 的权威公共查询并写入 CloudWatch Logs；Resolver Query Logging 记录 VPC、Private Zone、Resolver Endpoint 与 DNS Firewall 查询，可写 S3、CloudWatch Logs 或 Firehose，并通过 AWS RAM 跨 Account 共享。
English
Route 53 has two main logging modes. DNS query logging records authoritative public-hosted-zone queries and sends them to CloudWatch Logs. Resolver query logging captures VPC, private-zone, resolver-endpoint, and DNS Firewall activity; it can deliver to S3, CloudWatch Logs, or Firehose and can be shared across accounts through AWS RAM.
返回顶部 ↑