使用 Route 53 的解析器示例 AWS CLI - AWS SDK代码示例
操作

AWS 文档 AWS SDK示例 GitHub 存储库中还有更多SDK示例。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用 Route 53 的解析器示例 AWS CLI

以下代码示例向您展示了如何使用与 Route 53 Resolver AWS Command Line Interface 配合使用来执行操作和实现常见场景。

操作是大型程序的代码摘录，必须在上下文中运行。您可以通过操作了解如何调用单个服务函数，还可以通过函数相关场景的上下文查看操作。

每个示例都包含一个指向完整源代码的链接，您可以在其中找到有关如何在上下文中设置和运行代码的说明。

主题

操作

以下代码示例演示如何使用 associate-firewall-rule-group。

AWS CLI

将防火墙规则组与相关联 VPC

以下associate-firewall-rule-group示例将DNS防火墙规则组与 Amazon 相关联VPC。

aws route53resolver associate-firewall-rule-group \
    --name test-association \
    --firewall-rule-group-id rslvr-frg-47f93271fexample \
    --vpc-id vpc-31e92222 \
    --priority 101

输出：

{
    "FirewallRuleGroupAssociation": {
        "Id": "rslvr-frgassoc-57e8873d7example",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group-association/rslvr-frgassoc-57e8873d7example",
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "VpcId": "vpc-31e92222",
        "Name": "test-association",
        "Priority": 101,
        "MutationProtection": "DISABLED",
        "Status": "UPDATING",
        "StatusMessage": "Creating Firewall Rule Group Association",
        "CreatorRequestId": "2ca1a304-32b3-4f5f-bc4c-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:47:48.755768Z",
        "ModificationTime": "2021-05-25T21:47:48.755768Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理您VPC和 Route 53 解析器DNS防火墙规则组之间的关联。

以下代码示例演示如何使用 associate-resolver-endpoint-ip-address。

AWS CLI

将另一个 IP 地址与解析器端点相关联

以下associate-resolver-endpoint-ip-address示例将另一个 IP 地址与入站解析器端点相关联。如果您仅指定子网 ID 而在--ip-address参数中省略了 IP 地址，则 Resolver 会从指定子网中的可用 IP 地址中为您选择一个 IP 地址。

aws route53resolver associate-resolver-endpoint-ip-address \
    --resolver-endpoint-id rslvr-in-497098ad5example \
    --ip-address="SubnetId=subnet-12d8exam,Ip=192.0.2.118"

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-497098ad5example",
        "CreatorRequestId": "AWSConsole.25.0123456789",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-497098ad5example",
        "Name": "my-inbound-endpoint",
        "SecurityGroupIds": [
            "sg-05cd7b25d6example"
        ],
        "Direction": "INBOUND",
        "IpAddressCount": 3,
        "HostVPCId": "vpc-304bexam",
        "Status": "UPDATING",
        "StatusMessage": "Updating the Resolver Endpoint",
        "CreationTime": "2020-01-02T23:25:45.538Z",
        "ModificationTime": "2020-01-02T23:25:45.538Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的您在创建或编辑入站终端节点时指定的值。

以下代码示例演示如何使用 associate-resolver-rule。

AWS CLI

将解析器规则与关联 VPC

以下associate-resolver-rule示例将解决程序规则与 Amazon VPC 相关联。运行命令后，Resolver 开始根据规则中的设置（例如转发的DNS查询的域名）将查询转发到您的网络。

aws route53resolver associate-resolver-rule \
    --name my-resolver-rule-association \
    --resolver-rule-id rslvr-rr-42b60677c0example \
    --vpc-id vpc-304bexam

输出：

{
    "ResolverRuleAssociation": {
        "Id": "rslvr-rrassoc-d61cbb2c8bexample",
        "ResolverRuleId": "rslvr-rr-42b60677c0example",
        "Name": "my-resolver-rule-association",
        "VPCId": "vpc-304bexam",
        "Status": "CREATING",
        "StatusMessage": "[Trace id: 1-5dc5a8fa-ec2cc480d2ef07617example] Creating the association."
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的将出站DNS查询转发到您的网络。

以下代码示例演示如何使用 create-firewall-domain-list。

AWS CLI

创建 Route 53 解析器DNS防火墙域列表

以下create-firewall-domain-list示例在您的 AWS 账户中创建名为 test 的 Route 53 Resolver DNS 防火墙域列表。

aws route53resolver create-firewall-domain-list \
    --creator-request-id my-request-id \
    --name test

输出：

{
    "FirewallDomainList": {
        "Id": "rslvr-fdl-d61cbb2cbexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-domain-list/rslvr-fdl-d61cbb2cbexample",
        "Name": "test",
        "DomainCount": 0,
        "Status": "COMPLETE",
        "StatusMessage": "Created Firewall Domain List",
        "CreatorRequestId": "my-request-id",
        "CreationTime": "2021-05-25T15:55:51.115365Z",
        "ModificationTime": "2021-05-25T15:55:51.115365Z"
    }
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 create-firewall-rule-group。

AWS CLI

创建防火墙规则组

以下create-firewall-rule-group示例创建了DNS防火墙规则组。

aws route53resolver create-firewall-rule-group \
    --creator-request-id my-request-id \
    --name test

输出：

{
    "FirewallRuleGroup": {
        "Id": "rslvr-frg-47f93271fexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group/rslvr-frg-47f93271fexample",
        "Name": "test",
        "RuleCount": 0,
        "Status": "COMPLETE",
        "StatusMessage": "Created Firewall Rule Group",
        "OwnerId": "123456789012",
        "CreatorRequestId": "my-request-id",
        "ShareStatus": "NOT_SHARED",
        "CreationTime": "2021-05-25T18:59:26.490017Z",
        "ModificationTime": "2021-05-25T18:59:26.490017Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 create-firewall-rule。

AWS CLI

创建防火墙规则

以下create-firewall-rule示例在防火墙规则中为DNS防火墙域列表中列出的域创建DNS防火墙规则。

aws route53resolver create-firewall-rule \
    --name allow-rule \
    --firewall-rule-group-id rslvr-frg-47f93271fexample \
    --firewall-domain-list-id rslvr-fdl-9e956e9ffexample \
    --priority 101 \
    --action ALLOW

输出：

{
    "FirewallRule": {
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "FirewallDomainListId": "rslvr-fdl-9e956e9ffexample",
        "Name": "allow-rule",
        "Priority": 101,
        "Action": "ALLOW",
        "CreatorRequestId": "d81e3fb7-020b-415e-939f-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:44:00.346093Z",
        "ModificationTime": "2021-05-25T21:44:00.346093Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 create-resolver-endpoint。

AWS CLI

创建入站解析器终端节点

以下create-resolver-endpoint示例创建了一个入站解析器端点。您可以使用相同的命令来创建入站和出站终端节点。

aws route53resolver — create-resolver-endpoint name — creator-request-id 2020-01-01-18:47 — “sg-f62bexam” — security-group-ids “sg-f62 my-inbound-endpoint bexam” — direction--ip-addressions =subnet-ba47exam，Ip=192.0.2.255 =subnet-12d8exam，Ip=192.0.2.254 INBOUND SubnetId SubnetId

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-f9ab8a03f1example",
        "CreatorRequestId": "2020-01-01-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-f9ab8a03f1example",
        "Name": "my-inbound-endpoint",
        "SecurityGroupIds": [
            "sg-f62bexam"
        ],
        "Direction": "INBOUND",
        "IpAddressCount": 2,
        "HostVPCId": "vpc-304examp",
        "Status": "CREATING",
        "StatusMessage": "[Trace id: 1-5dc1ff84-f3477826e4a190025example] Creating the Resolver Endpoint",
        "CreationTime": "2020-01-01T23:02:29.583Z",
        "ModificationTime": "2020-01-01T23:02:29.583Z"
    }
}

创建出站解析器终端节点

以下create-resolver-endpoint示例使用JSON格式文档中的值创建出站解析器端点。create-outbound-resolver-endpoint.json

aws route53resolver create-resolver-endpoint \
    --cli-input-json file://c:\temp\create-outbound-resolver-endpoint.json

create-outbound-resolver-endpoint.json 的内容：

{
   "CreatorRequestId": "2020-01-01-18:47",
   "Direction": "OUTBOUND",
   "IpAddresses": [
      {
         "Ip": "192.0.2.255",
         "SubnetId": "subnet-ba47exam"
      },
      {
         "Ip": "192.0.2.254",
         "SubnetId": "subnet-12d8exam"
      }
   ],
   "Name": "my-outbound-endpoint",
   "SecurityGroupIds": [ "sg-05cd7b25d6example" ],
   "Tags": [
      {
         "Key": "my-key-name",
         "Value": "my-key-value"
      }
   ]
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的解决与您的网络之间的DNSVPCs查询。

以下代码示例演示如何使用 create-resolver-rule。

AWS CLI

创建解析器规则

以下create-resolver-rule示例创建了 Resolver 转发规则。该规则使用出站终端节点 rslvr-out-d 5e5920e37example 将DNS查询转发到 IP 地址 10.24.8.75 和 10.24. example.com 8.156。

aws route53resolver create-resolver-rule \
    --creator-request-id 2020-01-02-18:47 \
    --domain-name example.com \
    --name my-rule \
    --resolver-endpoint-id rslvr-out-d5e5920e37example \
    --rule-type FORWARD \
    --target-ips "Ip=10.24.8.75" "Ip=10.24.8.156"

输出：

{
    "ResolverRule": {
        "Status": "COMPLETE",
        "RuleType": "FORWARD",
        "ResolverEndpointId": "rslvr-out-d5e5920e37example",
        "Name": "my-rule",
        "DomainName": "example.com.",
        "CreationTime": "2022-05-10T21:35:30.923187Z",
        "TargetIps": [
            {
                "Ip": "10.24.8.75",
                "Port": 53
            },
            {
                "Ip": "10.24.8.156",
                "Port": 53
            }
        ],
        "CreatorRequestId": "2022-05-10-16:33",
        "ModificationTime": "2022-05-10T21:35:30.923187Z",
        "ShareStatus": "NOT_SHARED",
        "Arn": "arn:aws:route53resolver:us-east-1:111117012054:resolver-rule/rslvr-rr-b1e0b905e93611111",
        "OwnerId": "111111111111",
        "Id": "rslvr-rr-rslvr-rr-b1e0b905e93611111",
        "StatusMessage": "[Trace id: 1-22222222-3e56afcc71a3724664f22e24] Successfully created Resolver Rule."
    }
}

以下代码示例演示如何使用 delete-firewall-domain-list。

AWS CLI

删除 Route 53 解析器DNS防火墙域列表

以下delete-firewall-domain-list示例删除了您 AWS 账户中名为 test 的 Route 53 Resolver DNS 防火墙域列表。

aws route53resolver delete-firewall-domain-list \
    --firewall-domain-list-id rslvr-fdl-9e956e9ffexample

输出：

{
    "FirewallDomainList": {
        "Id": "rslvr-fdl-9e956e9ffexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-domain-list/rslvr-fdl-9e956e9ffexample",
        "Name": "test",
        "DomainCount": 6,
        "Status": "DELETING",
        "StatusMessage": "Deleting the Firewall Domain List",
        "CreatorRequestId": "my-request-id",
        "CreationTime": "2021-05-25T15:55:51.115365Z",
        "ModificationTime": "2021-05-25T18:58:05.588024Z"
    }
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 delete-firewall-rule-group。

AWS CLI

删除防火墙规则组

以下delete-firewall-rule-group示例删除防火墙规则组。

aws route53resolver delete-firewall-rule-group \
    --firewall-rule-group-id rslvr-frg-47f93271fexample

输出：

{
    "FirewallRuleGroup": {
        "Id": "rslvr-frg-47f93271fexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group/rslvr-frg-47f93271fexample",
        "Name": "test",
        "RuleCount": 0,
        "Status": "UPDATING",
        "StatusMessage": "Updating Firewall Rule Group",
        "OwnerId": "123456789012",
        "CreatorRequestId": "my-request-id",
        "ShareStatus": "NOT_SHARED",
        "CreationTime": "2021-05-25T18:59:26.490017Z",
        "ModificationTime": "2021-05-25T21:51:53.028688Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 delete-firewall-rule。

AWS CLI

删除防火墙规则

以下delete-firewall-rule示例删除了指定的防火墙规则。

aws route53resolver delete-firewall-rule \
    --firewall-rule-group-id rslvr-frg-47f93271fexample \
    --firewall-domain-list-id rslvr-fdl-9e956e9ffexample

输出：

{
    "FirewallRule": {
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "FirewallDomainListId": "rslvr-fdl-9e956e9ffexample",
        "Name": "allow-rule",
        "Priority": 102,
        "Action": "ALLOW",
        "CreatorRequestId": "d81e3fb7-020b-415e-939f-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:44:00.346093Z",
        "ModificationTime": "2021-05-25T21:45:59.611600Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 delete-resolver-endpoint。

AWS CLI

删除解析器端点

以下delete-resolver-endpoint示例删除了指定的终端节点。

重要信息如果您删除入站终端节点，则来自您的网络的DNS查询将不再转发到您在终端节点中指定的解析器。VPC如果您删除出站终端节点，Resolver 会停止将DNS查询从您的网络转发VPC到您的网络，以获取指定已删除出站终端节点的规则。

aws route53resolver delete-resolver-endpoint \
    --resolver-endpoint-id rslvr-in-497098ad59example

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-497098ad59example",
        "CreatorRequestId": "AWSConsole.25.157290example",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-497098ad59example",
        "Name": "my-inbound-endpoint",
        "SecurityGroupIds": [
            "sg-05cd7b25d6example"
        ],
        "Direction": "INBOUND",
        "IpAddressCount": 5,
        "HostVPCId": "vpc-304bexam",
        "Status": "DELETING",
        "StatusMessage": "[Trace id: 1-5dc5b658-811b5be0922bbc382example] Deleting ResolverEndpoint.",
        "CreationTime": "2020-01-01T23:25:45.538Z",
        "ModificationTime": "2020-01-02T23:25:45.538Z"
    }
}

以下代码示例演示如何使用 delete-resolver-rule。

AWS CLI

删除解析器规则

以下delete-resolver-rule示例删除了指定的规则。

注意如果规则与任何规则关联VPCs，则必须先取消该规则与的关联，VPCs然后才能将其删除。

aws route53resolver delete-resolver-rule \
    --resolver-rule-id rslvr-rr-5b3809426bexample

输出：

{
    "ResolverRule": {
        "Id": "rslvr-rr-5b3809426bexample",
        "CreatorRequestId": "2020-01-03-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-5b3809426bexample",
        "DomainName": "zenith.example.com.",
        "Status": "DELETING",
        "StatusMessage": "[Trace id: 1-5dc5e05b-602e67b052cb74f05example] Deleting Resolver Rule.",
        "RuleType": "FORWARD",
        "Name": "my-resolver-rule",
        "TargetIps": [
            {
                "Ip": "192.0.2.50",
                "Port": 53
            }
        ],
        "ResolverEndpointId": "rslvr-out-d5e5920e3example",
        "OwnerId": "111122223333",
        "ShareStatus": "NOT_SHARED"
    }
}

以下代码示例演示如何使用 disassociate-firewall-rule-group。

AWS CLI

取消防火墙规则组与防火墙规则组的关联 VPC

以下disassociate-firewall-rule-group示例取消DNS防火墙规则组与 Amazon VPC 的关联。

aws route53resolver disassociate-firewall-rule-group \
    --firewall-rule-group-association-id rslvr-frgassoc-57e8873d7example

输出：

{
    "FirewallRuleGroupAssociation": {
        "Id": "rslvr-frgassoc-57e8873d7example",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group-association/rslvr-frgassoc-57e8873d7example",
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "VpcId": "vpc-31e92222",
        "Name": "test-association",
        "Priority": 103,
        "MutationProtection": "DISABLED",
        "Status": "DELETING",
        "StatusMessage": "Deleting the Firewall Rule Group Association",
        "CreatorRequestId": "2ca1a304-32b3-4f5f-bc4c-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:47:48.755768Z",
        "ModificationTime": "2021-05-25T21:51:02.377887Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理您VPC和 Route 53 解析器DNS防火墙规则组之间的关联。

以下代码示例演示如何使用 disassociate-resolver-endpoint-ip-address。

AWS CLI

解除 IP 地址与解析器端点的关联

以下disassociate-resolver-endpoint-ip-address示例从指定的 Resolver 入站或出站终端节点中删除 IP 地址。

注意一个端点必须至少有两个 IP 地址。如果一个端点当前只有两个 IP 地址，并且您想将一个地址替换为另一个地址，则必须先使用 associate-resolver-endpoint-ip-address 来关联新的 IP 地址。然后，您可以取消其中一个原始 IP 地址与终端节点的关联。

aws route53resolver disassociate-resolver-endpoint-ip-address \
    --resolver-endpoint-id rslvr-in-f9ab8a03f1example \
    --ip-address="SubnetId=subnet-12d8a459,Ip=172.31.40.121"

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-f9ab8a03f1example",
        "CreatorRequestId": "2020-01-01-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-f9ab8a03f1example",
        "Name": "my-inbound-endpoint",
        "SecurityGroupIds": [
            "sg-f62bexam"
        ],
        "Direction": "INBOUND",
        "IpAddressCount": 3,
        "HostVPCId": "vpc-304bexam",
        "Status": "UPDATING",
        "StatusMessage": "Updating the Resolver Endpoint",
        "CreationTime": "2020-01-01T23:02:29.583Z",
        "ModificationTime": "2020-01-05T23:02:29.583Z"
    }
}

以下代码示例演示如何使用 disassociate-resolver-rule。

AWS CLI

解除处理程序规则与 Amazon 的关联 VPC

以下disassociate-resolver-rule示例删除了指定的 Resolver 规则与指定规则之间的关联。VPC在以下情况下，您可以取消规则与VPC的关联：

对于由此产生的DNS查询VPC，您希望 Resolver 停止向您的网络转发规则中指定的域名的查询。您要删除转发规则。如果某条规则当前与一个或多个规则关联VPCs，则必须先取消该规则与所有规则的关联，VPCs然后才能将其删除。

aws route53resolver disassociate-resolver-rule \
    --resolver-rule-id rslvr-rr-4955cb98ceexample \
    --vpc-id vpc-304bexam

输出：

{
    "ResolverRuleAssociation": {
        "Id": "rslvr-rrassoc-322f4e8b9cexample",
        "ResolverRuleId": "rslvr-rr-4955cb98ceexample",
        "Name": "my-resolver-rule-association",
        "VPCId": "vpc-304bexam",
        "Status": "DELETING",
        "StatusMessage": "[Trace id: 1-5dc5ffa2-a26c38004c1f94006example] Deleting Association"
    }
}

以下代码示例演示如何使用 get-firewall-config。

AWS CLI

获取的防火墙配置 VPC

以下get-firewall-config示例检索指定的DNSVPC防火墙行为。

aws route53resolver get-firewall-config \
    --resource-id vpc-31e92222

输出：

{
    "FirewallConfig": {
        "Id": "rslvr-fc-86016850cexample",
        "ResourceId": "vpc-31e9222",
        "OwnerId": "123456789012",
        "FirewallFailOpen": "DISABLED"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发人员指南中的DNS防火墙VPC配置。

以下代码示例演示如何使用 get-firewall-domain-list。

AWS CLI

获取 Route 53 解析器DNS防火墙域名列表

以下get-firewall-domain-list示例使用您指定 ID 检索域列表。

aws route53resolver get-firewall-domain-list \
    --firewall-domain-list-id rslvr-fdl-42b60677cexample

输出：

{
    "FirewallDomainList": {
        "Id": "rslvr-fdl-9e956e9ffexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123457689012:firewall-domain-list/rslvr-fdl-42b60677cexample",
        "Name": "test",
        "DomainCount": 0,
        "Status": "COMPLETE",
        "StatusMessage": "Created Firewall Domain List",
        "CreatorRequestId": "my-request-id",
        "CreationTime": "2021-05-25T15:55:51.115365Z",
        "ModificationTime": "2021-05-25T15:55:51.115365Z"
    }
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 get-firewall-rule-group-association。

AWS CLI

获取防火墙规则组关联

以下get-firewall-rule-group-association示例检索防火墙规则组关联。

aws route53resolver get-firewall-rule-group-association \
    --firewall-rule-group-association-id rslvr-frgassoc-57e8873d7example

输出：

{
    "FirewallRuleGroupAssociation": {
        "Id": "rslvr-frgassoc-57e8873d7example",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group-association/rslvr-frgassoc-57e8873d7example",
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "VpcId": "vpc-31e92222",
        "Name": "test-association",
        "Priority": 101,
        "MutationProtection": "DISABLED",
        "Status": "COMPLETE",
        "StatusMessage": "Finished rule group association update",
        "CreatorRequestId": "2ca1a304-32b3-4f5f-bc4c-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:47:48.755768Z",
        "ModificationTime": "2021-05-25T21:47:48.755768Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理您VPC和 Route 53 解析器DNS防火墙规则组之间的关联。

以下代码示例演示如何使用 get-firewall-rule-group-policy。

AWS CLI

要获得 AWS IAM保单

以下get-firewall-rule-group-policy示例获取了用于共享指定规则组的 Ident AWS ity and Access Management (AWS IAM) 策略。

aws route53resolver get-firewall-rule-group-policy \
    --arn arn:aws:route53resolver:us-west-2:AWS_ACCOUNT_ID:firewall-rule-group/rslvr-frg-47f93271fexample

输出：

{
    "FirewallRuleGroupPolicy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"test\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::AWS_ACCOUNT_ID:root\"},\"Action\":[\"route53resolver:GetFirewallRuleGroup\",\"route53resolver:ListFirewallRuleGroups\"],\"Resource\":\"arn:aws:route53resolver:us-east-1:AWS_ACCOUNT_ID:firewall-rule-group/rslvr-frg-47f93271fexample\"}]}"
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 get-firewall-rule-group。

AWS CLI

获取防火墙规则组

以下get-firewall-rule-group示例使用您提供的 ID 检索有关DNS防火墙规则组的信息。

aws route53resolver get-firewall-rule-group \
    --firewall-rule-group-id rslvr-frg-47f93271fexample

输出：

{
    "FirewallRuleGroup": {
        "Id": "rslvr-frg-47f93271fexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group/rslvr-frg-47f93271fexample",
        "Name": "test",
        "RuleCount": 0,
        "Status": "COMPLETE",
        "StatusMessage": "Created Firewall Rule Group",
        "OwnerId": "123456789012",
        "CreatorRequestId": "my-request-id",
        "ShareStatus": "NOT_SHARED",
        "CreationTime": "2021-05-25T18:59:26.490017Z",
        "ModificationTime": "2021-05-25T18:59:26.490017Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 get-resolver-endpoint。

AWS CLI

获取有关解析器端点的信息

以下get-resolver-endpoint示例显示出站指定终端节点的详细信息。您可以通过指定适用的终端节点 ID 来同时get-resolver-endpoint用于入站和出站终端节点。

aws route53resolver get-resolver-endpoint \
    --resolver-endpoint-id rslvr-out-d5e5920e37example

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-out-d5e5920e37example",
        "CreatorRequestId": "2020-01-01-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-out-d5e5920e37example",
        "Name": "my-outbound-endpoint",
        "SecurityGroupIds": [
            "sg-05cd7b25d6example"
        ],
        "Direction": "OUTBOUND",
        "IpAddressCount": 2,
        "HostVPCId": "vpc-304bexam",
        "Status": "OPERATIONAL",
        "StatusMessage": "This Resolver Endpoint is operational.",
        "CreationTime": "2020-01-01T23:50:50.979Z",
        "ModificationTime": "2020-01-02T23:50:50.979Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的您在创建或编辑入站终端节点时指定的值。

以下代码示例演示如何使用 get-resolver-rule-association。

AWS CLI

获取有关解析器规则和解析器规则之间关联的信息 VPC

以下get-resolver-rule-association示例显示了有关指定的 Resolver 规则与之间关联的VPC详细信息。您将解析器规则和VPC使用associate-resolver-rule者相关联。

aws route53resolver get-resolver-rule-association \
    --resolver-rule-association-id rslvr-rrassoc-d61cbb2c8bexample

输出：

{
    "ResolverRuleAssociation": {
        "Id": "rslvr-rrassoc-d61cbb2c8bexample",
        "ResolverRuleId": "rslvr-rr-42b60677c0example",
        "Name": "my-resolver-rule-association",
        "VPCId": "vpc-304bexam",
        "Status": "COMPLETE",
        "StatusMessage": ""
    }
}

以下代码示例演示如何使用 get-resolver-rule。

AWS CLI

获取有关解析器规则的信息

以下get-resolver-rule示例显示有关指定解析器规则的详细信息，例如规则转发DNS查询的域名以及与该规则关联的出站解析器端点的 ID。

aws route53resolver get-resolver-rule \
    --resolver-rule-id rslvr-rr-42b60677c0example

输出：

{
    "ResolverRule": {
        "Id": "rslvr-rr-42b60677c0example",
        "CreatorRequestId": "2020-01-01-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-42b60677c0example",
        "DomainName": "example.com.",
        "Status": "COMPLETE",
        "StatusMessage": "[Trace id: 1-5dc4b177-ff1d9d001a0f80005example] Successfully created Resolver Rule.",
        "RuleType": "FORWARD",
        "Name": "my-rule",
        "TargetIps": [
            {
                "Ip": "192.0.2.45",
                "Port": 53
            }
        ],
        "ResolverEndpointId": "rslvr-out-d5e5920e37example",
        "OwnerId": "111122223333",
        "ShareStatus": "NOT_SHARED"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的您在创建或编辑规则时指定的值。

以下代码示例演示如何使用 import-firewall-domains。

AWS CLI

将域名导入域名列表

以下import-firewall-domains示例将一组域从文件导入到您指定的DNS防火墙域列表中。

aws route53resolver import-firewall-domains \
    --firewall-domain-list-id rslvr-fdl-d61cbb2cbexample \
    --operation REPLACE \
    --domain-file-url s3://PATH/TO/YOUR/FILE

输出：

{
    "Id": "rslvr-fdl-d61cbb2cbexample",
    "Name": "test",
    "Status": "IMPORTING",
    "StatusMessage": "Importing domains from provided file."
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 list-firewall-configs。

AWS CLI

列出防火墙配置

以下list-firewall-configs示例列出了您的DNS防火墙配置。

aws route53resolver list-firewall-configs

输出：

{
    "FirewallConfigs": [
        {
            "Id": "rslvr-fc-86016850cexample",
            "ResourceId": "vpc-31e92222",
            "OwnerId": "123456789012",
            "FirewallFailOpen": "DISABLED"
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发人员指南中的DNS防火墙VPC配置。

以下代码示例演示如何使用 list-firewall-domain-lists。

AWS CLI

列出所有 Route 53 解析器DNS防火墙域列表

以下list-firewall-domain-lists示例列出了所有域名列表。

aws route53resolver list-firewall-domain-lists

输出：

{
    "FirewallDomainLists": [
        {
            "Id": "rslvr-fdl-2c46f2ecfexample",
            "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-domain-list/rslvr-fdl-2c46f2ecfexample",
            "Name": "AWSManagedDomainsMalwareDomainList",
            "CreatorRequestId": "AWSManagedDomainsMalwareDomainList",
            "ManagedOwnerName": "Route 53 Resolver DNS Firewall"
        },
        {
            "Id": "rslvr-fdl-aa970e9e1example",
            "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-domain-list/rslvr-fdl-aa970e9e1example",
            "Name": "AWSManagedDomainsBotnetCommandandControl",
            "CreatorRequestId": "AWSManagedDomainsBotnetCommandandControl",
            "ManagedOwnerName": "Route 53 Resolver DNS Firewall"
        },
        {
            "Id": "rslvr-fdl-42b60677cexample",
            "Arn": "arn:aws:route53resolver:us-west-2:123456789111:firewall-domain-list/rslvr-fdl-42b60677cexample",
            "Name": "test",
            "CreatorRequestId": "my-request-id"
        }
    ]
}

有关更多信息，请参阅《亚马逊 Route 53 开发者指南》中的 Route 53 解析器DNS防火墙域列表。

以下代码示例演示如何使用 list-firewall-domains。

AWS CLI

在域名列表中列出域名

以下list-firewall-domains示例列出了您指定的DNS防火墙域列表中的域。

aws route53resolver list-firewall-domains \
    --firewall-domain-list-id rslvr-fdl-d61cbb2cbexample

输出：

{
    "Domains": [
        "test1.com.",
        "test2.com.",
        "test3.com."
    ]
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 list-firewall-rule-group-associations。

AWS CLI

列出DNS防火墙规则组关联

以下list-firewall-rule-group-associations示例列出了您与 Amazon 的DNS防火墙规则组关联VPCs。

aws route53resolver list-firewall-rule-group-associations

输出：

{
    "FirewallRuleGroupAssociations": [
        {
            "Id": "rslvr-frgassoc-57e8873d7example",
            "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group-association/rslvr-frgassoc-57e8873d7example",
            "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
            "VpcId": "vpc-31e92222",
            "Name": "test-association",
            "Priority": 101,
            "MutationProtection": "DISABLED",
            "Status": "UPDATING",
            "StatusMessage": "Creating Firewall Rule Group Association",
            "CreatorRequestId": "2ca1a304-32b3-4f5f-bc4c-EXAMPLE11111",
            "CreationTime": "2021-05-25T21:47:48.755768Z",
            "ModificationTime": "2021-05-25T21:47:48.755768Z"
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理您VPC和 Route 53 解析器DNS防火墙规则组之间的关联。

以下代码示例演示如何使用 list-firewall-rule-groups。

AWS CLI

获取您的防火墙规则组列表

以下list-firewall-rule-groups示例列出了您的DNS防火墙规则组。

aws route53resolver list-firewall-rule-groups

输出：

{
    "FirewallRuleGroups": [
        {
            "Id": "rslvr-frg-47f93271fexample",
            "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group/rslvr-frg-47f93271fexample",
            "Name": "test",
            "OwnerId": "123456789012",
            "CreatorRequestId": "my-request-id",
            "ShareStatus": "NOT_SHARED"
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 list-firewall-rules。

AWS CLI

列出防火墙规则

以下list-firewall-rules示例列出了DNS防火墙规则组中的所有防火墙规则。

aws route53resolver list-firewall-rules \
    --firewall-rule-group-id rslvr-frg-47f93271fexample

输出：

{
    "FirewallRules": [
        {
            "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
            "FirewallDomainListId": "rslvr-fdl-9e956e9ffexample",
            "Name": "allow-rule",
            "Priority": 101,
            "Action": "ALLOW",
            "CreatorRequestId": "d81e3fb7-020b-415e-939f-EXAMPLE11111",
            "CreationTime": "2021-05-25T21:44:00.346093Z",
            "ModificationTime": "2021-05-25T21:44:00.346093Z"
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 list-resolver-endpoint-ip-addresses。

AWS CLI

列出指定入站或出站终端节点的 IP 地址

以下list-resolver-endpoint-ip-addresses示例列出了与入站终端节点关联的 IP 地址的相关信息rslvr-in-f9ab8a03f1example。您也可以通过指定适用的终端节点 ID 来list-resolver-endpoint-ip-addresses用于出站终端节点。

aws route53resolver list-resolver-endpoint-ip-addresses \
    --resolver-endpoint-id rslvr-in-f9ab8a03f1example

输出：

{
    "MaxResults": 10,
    "IpAddresses": [
        {
            "IpId": "rni-1de60cdbfeexample",
            "SubnetId": "subnet-ba47exam",
            "Ip": "192.0.2.44",
            "Status": "ATTACHED",
            "StatusMessage": "This IP address is operational.",
            "CreationTime": "2020-01-03T23:02:29.587Z",
            "ModificationTime": "2020-01-03T23:03:05.555Z"
        },
        {
            "IpId": "rni-aac7085e38example",
            "SubnetId": "subnet-12d8exam",
            "Ip": "192.0.2.45",
            "Status": "ATTACHED",
            "StatusMessage": "This IP address is operational.",
            "CreationTime": "2020-01-03T23:02:29.593Z",
            "ModificationTime": "2020-01-03T23:02:55.060Z"
        }
    ]
}

有关输出中值的更多信息，请参阅 Amazon Route 53 开发者指南中创建或编辑入站终端节点时指定的值以及创建或编辑出站终端节点时指定的值。

以下代码示例演示如何使用 list-resolver-endpoints。

AWS CLI

列出某个 AWS 区域中的解析器终端节点

以下list-resolver-endpoints示例列出了当前账户中存在的入站和出站 Resolver 终端节点。

aws route53resolver list-resolver-endpoints

输出：

{
    "MaxResults": 10,
    "ResolverEndpoints": [
        {
            "Id": "rslvr-in-497098ad59example",
            "CreatorRequestId": "2020-01-01-18:47",
            "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-497098ad59example",
            "Name": "my-inbound-endpoint",
            "SecurityGroupIds": [
                "sg-05cd7b25d6example"
            ],
            "Direction": "INBOUND",
            "IpAddressCount": 2,
            "HostVPCId": "vpc-304bexam",
            "Status": "OPERATIONAL",
            "StatusMessage": "This Resolver Endpoint is operational.",
            "CreationTime": "2020-01-01T23:25:45.538Z",
            "ModificationTime": "2020-01-01T23:25:45.538Z"
        },
        {
            "Id": "rslvr-out-d5e5920e37example",
            "CreatorRequestId": "2020-01-01-18:48",
            "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-out-d5e5920e37example",
            "Name": "my-outbound-endpoint",
            "SecurityGroupIds": [
                "sg-05cd7b25d6example"
            ],
            "Direction": "OUTBOUND",
            "IpAddressCount": 2,
            "HostVPCId": "vpc-304bexam",
            "Status": "OPERATIONAL",
            "StatusMessage": "This Resolver Endpoint is operational.",
            "CreationTime": "2020-01-01T23:50:50.979Z",
            "ModificationTime": "2020-01-01T23:50:50.979Z"
        }
    ]
}

以下代码示例演示如何使用 list-resolver-rule-associations。

AWS CLI

列出解析器规则与之间的关联 VPCs

以下list-resolver-rule-associations示例列出了解析器规则与当前 AWS 账户之间的关联。VPCs

aws route53resolver list-resolver-rule-associations

输出：

{
    "MaxResults": 30,
    "ResolverRuleAssociations": [
        {
            "Id": "rslvr-autodefined-assoc-vpc-304bexam-internet-resolver",
            "ResolverRuleId": "rslvr-autodefined-rr-internet-resolver",
            "Name": "System Rule Association",
            "VPCId": "vpc-304bexam",
            "Status": "COMPLETE",
            "StatusMessage": ""
        },
        {
            "Id": "rslvr-rrassoc-d61cbb2c8bexample",
            "ResolverRuleId": "rslvr-rr-42b60677c0example",
            "Name": "my-resolver-rule-association",
            "VPCId": "vpc-304bexam",
            "Status": "COMPLETE",
            "StatusMessage": ""
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的 Rou te 53 Resolver 如何VPCs将您的DNS查询转发到您的网络。

以下代码示例演示如何使用 list-resolver-rules。

AWS CLI

列出解析器规则

以下list-resolver-rules示例列出了当前 AWS 账户中的所有 Resolver 规则。

aws route53resolver list-resolver-rules

输出：

{
    "MaxResults": 30,
    "ResolverRules": [
        {
            "Id": "rslvr-autodefined-rr-internet-resolver",
            "CreatorRequestId": "",
            "Arn": "arn:aws:route53resolver:us-west-2::autodefined-rule/rslvr-autodefined-rr-internet-resolver",
            "DomainName": ".",
            "Status": "COMPLETE",
            "RuleType": "RECURSIVE",
            "Name": "Internet Resolver",
            "OwnerId": "Route 53 Resolver",
            "ShareStatus": "NOT_SHARED"
        },
        {
            "Id": "rslvr-rr-42b60677c0example",
            "CreatorRequestId": "2020-01-01-18:47",
            "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-42b60677c0bc4e299",
            "DomainName": "example.com.",
            "Status": "COMPLETE",
            "StatusMessage": "[Trace id: 1-5dc4b177-ff1d9d001a0f80005example] Successfully created Resolver Rule.",
            "RuleType": "FORWARD",
            "Name": "my-rule",
            "TargetIps": [
                {
                    "Ip": "192.0.2.45",
                    "Port": 53
                }
            ],
            "ResolverEndpointId": "rslvr-out-d5e5920e37example",
            "OwnerId": "111122223333",
            "ShareStatus": "NOT_SHARED"
        }
    ]
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的 Rou te 53 Resolver 如何VPCs将您的DNS查询转发到您的网络。

以下代码示例演示如何使用 list-tags-for-resource。

AWS CLI

列出解析器资源的标签

以下list-tags-for-resource示例列出了分配给指定解析器规则的标签。

aws route53resolver list-tags-for-resource \
    --resource-arn "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-42b60677c0example"

输出：

{
    "Tags": [
        {
            "Key": "my-key-1",
            "Value": "my-value-1"
        },
        {
            "Key": "my-key-2",
            "Value": "my-value-2"
        }
    ]
}

有关使用标签进行成本分配的信息，请参阅《B AWS illing and Cost Management 用户指南》中的使用成本分配标签。

以下代码示例演示如何使用 put-firewall-rule-group-policy。

AWS CLI

附加 AWS IAM策略以共享防火墙规则组策略

以下put-firewall-rule-group-policy示例附加了用于共享规则组的 I AWS dentity and Access Management (AWS IAM) 策略。

aws route53resolver put-firewall-rule-group-policy \
    --firewall-rule-group-policy "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"test\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::AWS_ACCOUNT_ID:root\"},\"Action\":[\"route53resolver:GetFirewallRuleGroup\",\"route53resolver:ListFirewallRuleGroups\"],\"Resource\":\"arn:aws:route53resolver:us-east-1:AWS_ACCOUNT_ID:firewall-rule-group/rslvr-frg-47f93271fexample\"}]}"

输出：

{
    "ReturnValue": true
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 put-resolver-rule-policy。

AWS CLI

与其他账户共享解析器规则 AWS

以下put-resolver-rule-policy示例指定了您要与其他 AWS 账户共享的 Resolver 规则、要与之共享规则的账户，以及您希望该账户能够对规则执行的与规则相关的操作。

注意您必须使用创建规则的同一账户的凭据运行此命令。

aws route53resolver put-resolver-rule-policy \
    --region us-east-1 \
    --arn "arn:aws:route53resolver:us-east-1:111122223333:resolver-rule/rslvr-rr-42b60677c0example" \
    --resolver-rule-policy "{\"Version\": \"2012-10-17\", \
        \"Statement\": [ { \
        \"Effect\" : \"Allow\", \
        \"Principal\" : {\"AWS\" : \"444455556666\" }, \
        \"Action\" : [ \
            \"route53resolver:GetResolverRule\", \
            \"route53resolver:AssociateResolverRule\", \
            \"route53resolver:DisassociateResolverRule\", \
            \"route53resolver:ListResolverRules\", \
            \"route53resolver:ListResolverRuleAssociations\" ], \
        \"Resource\" : [ \"arn:aws:route53resolver:us-east-1:111122223333:resolver-rule/rslvr-rr-42b60677c0example\" ] } ] }"

输出：

{
    "ReturnValue": true
}

运行后put-resolver-rule-policy，您可以运行以下两个 Resource Access Manager (RAM) 命令。您必须使用要与之共享规则的账户：

get-resource-share-invitations返回值resourceShareInvitationArn。您需要此值才能接受使用共享规则的邀请。 accept-resource-share-invitation接受使用共享规则的邀请。

有关更多信息，请参阅 文档：

get-resource-share-invitationsaccept-resource-share-invitationsAmazon Route 53 开发者指南中的与其他 AWS 账户共享转发规则并使用共享规则

以下代码示例演示如何使用 tag-resource。

AWS CLI

将标签与解析器资源相关联

以下tag-resource示例将两个标签键/值对与指定的 Resolver 规则关联起来。

aws route53resolver tag-resource \
    --resource-arn "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-42b60677c0example" \
    --tags "Key=my-key-1,Value=my-value-1" "Key=my-key-2,Value=my-value-2"

此命令不生成任何输出。

有关使用标签进行成本分配的信息，请参阅《B AWS illing and Cost Management 用户指南》中的使用成本分配标签。

以下代码示例演示如何使用 untag-resource。

AWS CLI

从解析器资源中移除标签

以下untag-resource示例从指定的 Resolver 规则中删除两个标签。

aws route53resolver untag-resource \
    --resource-arn "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-42b60677c0example" \
    --tag-keys my-key-1 my-key-2

此命令不生成任何输出。要确认标签已被删除，可以使用list-tags-for-resource。

有关使用标签进行成本分配的信息，请参阅《B AWS illing and Cost Management 用户指南》中的使用成本分配标签。

以下代码示例演示如何使用 update-firewall-config。

AWS CLI

更新防火墙配置

以下update-firewall-config示例更新了DNS防火墙配置。

aws route53resolver update-firewall-config \
    --resource-id vpc-31e92222 \
    --firewall-fail-open DISABLED

输出：

{
    "FirewallConfig": {
        "Id": "rslvr-fc-86016850cexample",
        "ResourceId": "vpc-31e92222",
        "OwnerId": "123456789012",
        "FirewallFailOpen": "DISABLED"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发人员指南中的DNS防火墙VPC配置。

以下代码示例演示如何使用 update-firewall-domains。

AWS CLI

更新域名列表

以下update-firewall-domains示例使用您提供的 ID 将域名添加到域名列表中。

aws route53resolver update-firewall-domains \
    --firewall-domain-list-id rslvr-fdl-42b60677cexampleb \
    --operation ADD \
    --domains test1.com test2.com test3.com

输出：

{
    "Id": "rslvr-fdl-42b60677cexample",
    "Name": "test",
    "Status": "UPDATING",
    "StatusMessage": "Updating the Firewall Domain List"
}

有关更多信息，请参阅《Amazon Route 53 开发者指南》中的管理自己的域名列表。

以下代码示例演示如何使用 update-firewall-rule-group-association。

AWS CLI

更新防火墙规则组关联

以下update-firewall-rule-group-association示例更新了防火墙规则组关联。

aws route53resolver update-firewall-rule-group-association \
    --firewall-rule-group-association-id rslvr-frgassoc-57e8873d7example \
    --priority 103

输出：

{
    "FirewallRuleGroupAssociation": {
        "Id": "rslvr-frgassoc-57e8873d7example",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group-association/rslvr-frgassoc-57e8873d7example",
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "VpcId": "vpc-31e92222",
        "Name": "test-association",
        "Priority": 103,
        "MutationProtection": "DISABLED",
        "Status": "UPDATING",
        "StatusMessage": "Updating the Firewall Rule Group Association Attributes",
        "CreatorRequestId": "2ca1a304-32b3-4f5f-bc4c-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:47:48.755768Z",
        "ModificationTime": "2021-05-25T21:50:09.272569Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理您VPC和 Route 53 解析器DNS防火墙规则组之间的关联。

以下代码示例演示如何使用 update-firewall-rule。

AWS CLI

更新防火墙规则

以下update-firewall-rule示例使用您指定的参数更新防火墙规则。

aws route53resolver update-firewall-rule \
    --firewall-rule-group-id rslvr-frg-47f93271fexample \
    --firewall-domain-list-id rslvr-fdl-9e956e9ffexample \
    --priority 102

输出：

{
    "FirewallRule": {
        "FirewallRuleGroupId": "rslvr-frg-47f93271fexample",
        "FirewallDomainListId": "rslvr-fdl-9e956e9ffexample",
        "Name": "allow-rule",
        "Priority": 102,
        "Action": "ALLOW",
        "CreatorRequestId": "d81e3fb7-020b-415e-939f-EXAMPLE11111",
        "CreationTime": "2021-05-25T21:44:00.346093Z",
        "ModificationTime": "2021-05-25T21:45:59.611600Z"
    }
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的管理DNS防火墙中的规则组和规则。

以下代码示例演示如何使用 update-resolver-endpoint。

AWS CLI

更新解析器端点的名称

以下update-resolver-endpoint示例更新了解析器端点的名称。不支持更新其他值。

aws route53resolver update-resolver-endpoint \
    --resolver-endpoint-id rslvr-in-b5d45e32bdc445f09 \
    --name my-renamed-inbound-endpoint

输出：

{
    "ResolverEndpoint": {
        "Id": "rslvr-in-b5d45e32bdexample",
        "CreatorRequestId": "2020-01-02-18:48",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-endpoint/rslvr-in-b5d45e32bdexample",
        "Name": "my-renamed-inbound-endpoint",
        "SecurityGroupIds": [
            "sg-f62bexam"
        ],
        "Direction": "INBOUND",
        "IpAddressCount": 2,
        "HostVPCId": "vpc-304bexam",
        "Status": "OPERATIONAL",
        "StatusMessage": "This Resolver Endpoint is operational.",
        "CreationTime": "2020-01-01T18:33:59.265Z",
        "ModificationTime": "2020-01-08T18:33:59.265Z"
    }
}

以下代码示例演示如何使用 update-resolver-rule。

AWS CLI

示例 1：更新设置解析器端点

以下update-resolver-rule示例更新了规则的名称、查询转发到的本地网络上的 IP 地址以及用于将DNS查询转发到网络的出站 Resolver 端点的 ID。

注意的现有值TargetIps会被覆盖，因此您必须指定更新后希望规则拥有的所有 IP 地址。

aws route53resolver update-resolver-rule \
    --resolver-rule-id rslvr-rr-1247fa64f3example \
    --config Name="my-2nd-rule",TargetIps=[{Ip=192.0.2.45,Port=53},{Ip=192.0.2.46,Port=53}],ResolverEndpointId=rslvr-out-7b89ed0d25example

输出：

{
    "ResolverRule": {
        "Id": "rslvr-rr-1247fa64f3example",
        "CreatorRequestId": "2020-01-02-18:47",
        "Arn": "arn:aws:route53resolver:us-west-2:111122223333:resolver-rule/rslvr-rr-1247fa64f3example",
        "DomainName": "www.example.com.",
        "Status": "COMPLETE",
        "StatusMessage": "[Trace id: 1-5dcc90b9-8a8ee860aba1ebd89example] Successfully updated Resolver Rule.",
        "RuleType": "FORWARD",
        "Name": "my-2nd-rule",
        "TargetIps": [
            {
                "Ip": "192.0.2.45",
                "Port": 53
            },
            {
                "Ip": "192.0.2.46",
                "Port": 53
            }
        ],
        "ResolverEndpointId": "rslvr-out-7b89ed0d25example",
        "OwnerId": "111122223333",
        "ShareStatus": "NOT_SHARED"
    }
}

示例 2：使用文件进行 “配置” 设置更新解析器端点

或者，您也可以将config设置包含在JSON文件中，然后在调用时指定该文件update-resolver-rule。

aws route53resolver update-resolver-rule \
    --resolver-rule-id rslvr-rr-1247fa64f3example \
    --config file://c:\temp\update-resolver-rule.json

update-resolver-rule.json 的内容。

{
    "Name": "my-2nd-rule",
    "TargetIps": [
        {
            "Ip": "192.0.2.45",
            "Port": 53
        },
        {
            "Ip": "192.0.2.46",
            "Port": 53
        }
    ],
    "ResolverEndpointId": "rslvr-out-7b89ed0d25example"
}

有关更多信息，请参阅 Amazon Route 53 开发者指南中的您在创建或编辑规则时指定的值。