Route 53 Resolver

11 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

ResolverEndpoint # GA

ResolverEndpoint is the Schema for managing Route53 Resolver endpoints.

kubectl get resolverendpoints · example on GitHub

Example

# ResolverEndpoint — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#resolverendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: ResolverEndpoint
metadata:
  name: example-resolverendpoint
  namespace: default
spec:
  direction: INBOUND
  ipAddresses:
  - ip: example
    subnetID: subnet-0abc12def3456789
  name: example-resolverendpoint
  providerRef:
    name: example-resolverendpoint
    region: us-east-1
  securityGroupIDs:
  - example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`direction`	enum	yes	Direction is INBOUND or OUTBOUND. Allowed: `INBOUND, OUTBOUND`
`ipAddresses`	array<object>	yes	IPAddresses is the list of IP address objects.
`ipAddresses[].ip`	string	—	IP is the specific IP address (optional; auto-assigned if omitted).
`ipAddresses[].subnetID`	string	yes	SubnetID is the subnet for this IP address.
`name`	string	yes	Name is the friendly name of the endpoint.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroupIDs`	array<string>	yes	SecurityGroupIDs is the list of security group IDs.
`tags`	map<string>	—	Tags are metadata tags for the endpoint.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpointID`	string	—	EndpointID is the unique identifier of the endpoint.
`hostVpcID`	string	—	HostVPCID is the VPC that hosts the endpoint.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the current status (CREATING, OPERATIONAL, DELETING, etc.).

ResolverRule # GA

ResolverRule is the Schema for managing Route53 Resolver forwarding rules.

kubectl get resolverrules · example on GitHub

Example

# ResolverRule — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#resolverrule
apiVersion: aws.konfig.io/v1alpha1
kind: ResolverRule
metadata:
  name: example-resolverrule
  namespace: default
spec:
  domainName: example-resolverrule
  name: example-resolverrule
  providerRef:
    name: example-resolverrule
    region: us-east-1
  ruleType: FORWARD
  tags:
    environment: dev
    team: platform
  targetIPs:
  - ip: example
    port: 443

Spec

Field	Type	Required	Description
`domainName`	string	yes	DomainName is the DNS domain that this rule applies to.
`name`	string	yes	Name is the friendly name of the rule.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resolverEndpointID`	string	—	ResolverEndpointID is the ID of the outbound endpoint for forwarding.
`ruleType`	enum	yes	RuleType is FORWARD, SYSTEM, or RECURSIVE. Allowed: `FORWARD, SYSTEM, RECURSIVE`
`tags`	map<string>	—	Tags are metadata tags for the rule.
`targetIPs`	array<object>	—	TargetIPs are the DNS servers to forward queries to.
`targetIPs[].ip`	string	yes	IP is the IP address.
`targetIPs[].port`	integer	—	Port is the port (default 53).

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`ruleARN`	string	—	RuleARN is the ARN of the rule.
`ruleID`	string	—	RuleID is the unique identifier of the rule.
`status`	string	—	Status is the current status of the rule.

Route53ResolverFirewallDomainList # CLOUD CONTROL · AWS::Route53Resolver::FirewallDomainList

Route53ResolverFirewallDomainList manages AWS::Route53Resolver::FirewallDomainList through the AWS Cloud Control API.

kubectl get route53resolverfirewalldomainlists · example on GitHub

Example

# Route53ResolverFirewallDomainList — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverfirewalldomainlist
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverFirewallDomainList
metadata:
  name: example-route53resolverfirewalldomainlist
  namespace: default
spec:
  domainFileUrl: example
  domains:
  - example
  name: example-route53resolverfirewalldomainlist
  providerRef:
    name: example-route53resolverfirewalldomainlist
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`domainFileUrl`	string	—	S3 URL to import domains from.
`domains`	array<string>	—
`name`	string	—	FirewallDomainListName Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Arn Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`creatorRequestId`	string	—	The id of the creator request.
`domainCount`	integer	—	Count Read-only: reported by AWS after creation.
`id`	string	—	ResourceId Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`managedOwnerName`	string	—	ServicePrincipal Read-only: reported by AWS after creation.
`modificationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	ResolverFirewallDomainList, possible values are COMPLETE, DELETING, UPDATING, COMPLETE_IMPORT_FAILED, IMPORTING, and INACTIVE_OWNER_ACCOUNT_CLOSED. Allowed: `COMPLETE, DELETING, UPDATING, COMPLETE_IMPORT_FAILED, IMPORTING, INACTIVE_OWNER_ACCOUNT_CLOSED`
`statusMessage`	string	—	FirewallDomainListAssociationStatus Read-only: reported by AWS after creation.

Route53ResolverFirewallRuleGroup # CLOUD CONTROL · AWS::Route53Resolver::FirewallRuleGroup

Route53ResolverFirewallRuleGroup manages AWS::Route53Resolver::FirewallRuleGroup through the AWS Cloud Control API.

kubectl get route53resolverfirewallrulegroups · example on GitHub

Example

# Route53ResolverFirewallRuleGroup — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverfirewallrulegroup
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverFirewallRuleGroup
metadata:
  name: example-route53resolverfirewallrulegroup
  namespace: default
spec:
  firewallRules:
  - action: ALLOW
    blockOverrideDnsType: CNAME
    blockOverrideDomain: example
    blockOverrideTtl: 1
    blockResponse: NODATA
    confidenceThreshold: LOW
    dnsThreatProtection: DGA
    firewallDomainRedirectionAction: INSPECT_REDIRECTION_DOMAIN
    priority: 1
    qtype: example
    status: COMPLETE
  name: example-route53resolverfirewallrulegroup
  providerRef:
    name: example-route53resolverfirewallrulegroup
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`firewallRules`	array<object>	—	FirewallRules
`firewallRules[].action`	enum	yes	Rule Action Allowed: `ALLOW, BLOCK, ALERT`
`firewallRules[].blockOverrideDnsType`	enum	—	BlockOverrideDnsType Allowed: `CNAME`
`firewallRules[].blockOverrideDomain`	string	—	BlockOverrideDomain
`firewallRules[].blockOverrideTtl`	integer	—	BlockOverrideTtl
`firewallRules[].blockResponse`	enum	—	BlockResponse Allowed: `NODATA, NXDOMAIN, OVERRIDE`
`firewallRules[].confidenceThreshold`	enum	—	ConfidenceThreshold Allowed: `LOW, MEDIUM, HIGH`
`firewallRules[].dnsThreatProtection`	enum	—	DnsThreatProtection Allowed: `DGA, DNS_TUNNELING, DICTIONARY_DGA`
`firewallRules[].firewallDomainListId`	string	—	ResourceId
`firewallRules[].firewallDomainRedirectionAction`	enum	—	FirewallDomainRedirectionAction Allowed: `INSPECT_REDIRECTION_DOMAIN, TRUST_REDIRECTION_DOMAIN`
`firewallRules[].firewallRuleType`	object	—	Advanced firewall rule type.
`firewallRules[].firewallRuleType.firewallAdvancedContentCategory`	object	—	Route53ResolverFirewallRuleGroupFirewallAdvancedContentCategoryConfig is a nested property type of AWS::Route53Resolver::FirewallRuleGroup.
`firewallRules[].firewallRuleType.firewallAdvancedContentCategory.category`	string	yes	The content category value.
`firewallRules[].firewallRuleType.firewallAdvancedThreatCategory`	object	—	Route53ResolverFirewallRuleGroupFirewallAdvancedThreatCategoryConfig is a nested property type of AWS::Route53Resolver::FirewallRuleGroup.
`firewallRules[].firewallRuleType.firewallAdvancedThreatCategory.category`	string	yes	The threat category value.
`firewallRules[].firewallRuleType.partnerThreatProtection`	object	—	Route53ResolverFirewallRuleGroupPartnerThreatProtectionConfig is a nested property type of AWS::Route53Resolver::FirewallRuleGroup.
`firewallRules[].firewallRuleType.partnerThreatProtection.partner`	string	yes	The partner identifier value.
`firewallRules[].firewallThreatProtectionId`	string	—	ResourceId
`firewallRules[].priority`	integer	yes	Rule Priority
`firewallRules[].qtype`	string	—	Qtype
`firewallRules[].status`	enum	—	The status of the firewall rule. Allowed: `COMPLETE, CREATING, CREATION_FAILED`
`name`	string	—	FirewallRuleGroupName Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Arn Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`creatorRequestId`	string	—	The id of the creator request.
`id`	string	—	ResourceId Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`modificationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	AccountId Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`ruleCount`	integer	—	Count Read-only: reported by AWS after creation.
`shareStatus`	enum	—	ShareStatus, possible values are NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME. Allowed: `NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME`
`status`	enum	—	ResolverFirewallRuleGroupAssociation, possible values are COMPLETE, DELETING, UPDATING, and INACTIVE_OWNER_ACCOUNT_CLOSED. Allowed: `COMPLETE, DELETING, UPDATING, INACTIVE_OWNER_ACCOUNT_CLOSED`
`statusMessage`	string	—	FirewallRuleGroupStatus Read-only: reported by AWS after creation.

Route53ResolverFirewallRuleGroupAssociation # CLOUD CONTROL · AWS::Route53Resolver::FirewallRuleGroupAssociation

Route53ResolverFirewallRuleGroupAssociation manages AWS::Route53Resolver::FirewallRuleGroupAssociation through the AWS Cloud Control API.

kubectl get route53resolverfirewallrulegroupassociations · example on GitHub

Example

# Route53ResolverFirewallRuleGroupAssociation — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverfirewallrulegroupassociation
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverFirewallRuleGroupAssociation
metadata:
  name: example-route53resolverfirewallrulegroupassociation
  namespace: default
spec:
  firewallRuleGroupId: example-id
  mutationProtection: ENABLED
  name: example-route53resolverfirewallrulegroupassociation
  priority: 1
  providerRef:
    name: example-route53resolverfirewallrulegroupassociation
    region: us-east-1
  tags:
  - key: example
    value: example
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`firewallRuleGroupId`	string	yes	FirewallRuleGroupId Create-only in AWS: changing it requires replacing the resource.
`mutationProtection`	enum	—	MutationProtectionStatus Allowed: `ENABLED, DISABLED`
`name`	string	—	FirewallRuleGroupAssociationName
`priority`	integer	yes	Priority
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcId`	string	yes	VpcId Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`arn`	string	—	Arn Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`creatorRequestId`	string	—	The id of the creator request.
`id`	string	—	Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`managedOwnerName`	string	—	ServicePrincipal Read-only: reported by AWS after creation.
`modificationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	ResolverFirewallRuleGroupAssociation, possible values are COMPLETE, DELETING, UPDATING, and INACTIVE_OWNER_ACCOUNT_CLOSED. Allowed: `COMPLETE, DELETING, UPDATING, INACTIVE_OWNER_ACCOUNT_CLOSED`
`statusMessage`	string	—	FirewallDomainListAssociationStatus Read-only: reported by AWS after creation.

Route53ResolverOutpostResolver # CLOUD CONTROL · AWS::Route53Resolver::OutpostResolver

Route53ResolverOutpostResolver manages AWS::Route53Resolver::OutpostResolver through the AWS Cloud Control API.

kubectl get route53resolveroutpostresolvers · example on GitHub

Example

# Route53ResolverOutpostResolver — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolveroutpostresolver
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverOutpostResolver
metadata:
  name: example-route53resolveroutpostresolver
  namespace: default
spec:
  instanceCount: 4
  name: example-route53resolveroutpostresolver
  outpostArn: arn:aws:iam::123456789012:role/example-role
  preferredInstanceType: example
  providerRef:
    name: example-route53resolveroutpostresolver
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`instanceCount`	integer	—	The number of OutpostResolvers.
`name`	string	yes	The OutpostResolver name.
`outpostArn`	string	yes	The Outpost ARN.
`preferredInstanceType`	string	yes	The OutpostResolver instance type.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The OutpostResolver ARN.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The OutpostResolver creation time Read-only: reported by AWS after creation.
`creatorRequestId`	string	—	The id of the creator request.
`id`	string	—	Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`modificationTime`	string	—	The OutpostResolver last modified time Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The OutpostResolver status, possible values are CREATING, OPERATIONAL, UPDATING, DELETING, ACTION_NEEDED, FAILED_CREATION and FAILED_DELETION. Allowed: `CREATING, OPERATIONAL, DELETING, UPDATING, ACTION_NEEDED, FAILED_CREATION, FAILED_DELETION`
`statusMessage`	string	—	The OutpostResolver status message.

Route53ResolverResolverConfig # CLOUD CONTROL · AWS::Route53Resolver::ResolverConfig ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: per-VPC resolver setting; changes DNS for every workload in the VPC. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. Route53ResolverResolverConfig manages AWS::Route53Resolver::ResolverConfig through the AWS Cloud Control API.

kubectl get route53resolverresolverconfigs · example on GitHub

Example

# Route53ResolverResolverConfig — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverresolverconfig
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverResolverConfig
metadata:
  name: example-route53resolverresolverconfig
  namespace: default
spec:
  autodefinedReverseFlag: DISABLE
  providerRef:
    name: example-route53resolverresolverconfig
    region: us-east-1
  resourceId: example-id

Spec

Field	Type	Required	Description
`autodefinedReverseFlag`	enum	yes	Represents the desired status of AutodefinedReverse. Allowed: `DISABLE`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceId`	string	yes	ResourceId Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`autodefinedReverse`	enum	—	ResolverAutodefinedReverseStatus, possible values are ENABLING, ENABLED, DISABLING AND DISABLED. Allowed: `ENABLING, ENABLED, DISABLING, DISABLED`
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	AccountId Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

Route53ResolverResolverDNSSECConfig # CLOUD CONTROL · AWS::Route53Resolver::ResolverDNSSECConfig ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: per-VPC DNSSEC validation; misconfiguration breaks DNS for the VPC. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. Route53ResolverResolverDNSSECConfig manages AWS::Route53Resolver::ResolverDNSSECConfig through the AWS Cloud Control API.

kubectl get route53resolverresolverdnssecconfigs · example on GitHub

Example

# Route53ResolverResolverDNSSECConfig — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverresolverdnssecconfig
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverResolverDNSSECConfig
metadata:
  name: example-route53resolverresolverdnssecconfig
  namespace: default
spec:
  providerRef:
    name: example-route53resolverresolverdnssecconfig
    region: us-east-1

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceId`	string	—	ResourceId Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	AccountId Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`validationStatus`	enum	—	ResolverDNSSECValidationStatus, possible values are ENABLING, ENABLED, DISABLING AND DISABLED. Allowed: `ENABLING, ENABLED, DISABLING, DISABLED`

Route53ResolverResolverQueryLoggingConfig # CLOUD CONTROL · AWS::Route53Resolver::ResolverQueryLoggingConfig

Route53ResolverResolverQueryLoggingConfig manages AWS::Route53Resolver::ResolverQueryLoggingConfig through the AWS Cloud Control API.

kubectl get route53resolverresolverqueryloggingconfigs · example on GitHub

Example

# Route53ResolverResolverQueryLoggingConfig — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverresolverqueryloggingconfig
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverResolverQueryLoggingConfig
metadata:
  name: example-route53resolverresolverqueryloggingconfig
  namespace: default
spec:
  destinationArn: arn:aws:iam::123456789012:role/example-role
  name: example-route53resolverresolverqueryloggingconfig
  providerRef:
    name: example-route53resolverresolverqueryloggingconfig
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`destinationArn`	string	—	destination arn Create-only in AWS: changing it requires replacing the resource.
`name`	string	—	ResolverQueryLogConfigName Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Arn Read-only: reported by AWS after creation.
`associationCount`	integer	—	Count Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`creatorRequestId`	string	—	The id of the creator request.
`id`	string	—	ResourceId Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	AccountId Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`shareStatus`	enum	—	ShareStatus, possible values are NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME. Allowed: `NOT_SHARED, SHARED_WITH_ME, SHARED_BY_ME`
`status`	enum	—	ResolverQueryLogConfigStatus, possible values are CREATING, CREATED, DELETED AND FAILED. Allowed: `CREATING, CREATED, DELETING, FAILED`

Route53ResolverResolverQueryLoggingConfigAssociation # CLOUD CONTROL · AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation

Route53ResolverResolverQueryLoggingConfigAssociation manages AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation through the AWS Cloud Control API.

kubectl get route53resolverresolverqueryloggingconfigassociations · example on GitHub

Example

# Route53ResolverResolverQueryLoggingConfigAssociation — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverresolverqueryloggingconfigassociation
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverResolverQueryLoggingConfigAssociation
metadata:
  name: example-route53resolverresolverqueryloggingconfigassociation
  namespace: default
spec:
  providerRef:
    name: example-route53resolverresolverqueryloggingconfigassociation
    region: us-east-1

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resolverQueryLogConfigId`	string	—	ResolverQueryLogConfigId Create-only in AWS: changing it requires replacing the resource.
`resourceId`	string	—	ResourceId Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Rfc3339TimeString Read-only: reported by AWS after creation.
`error`	enum	—	ResolverQueryLogConfigAssociationError Read-only: reported by AWS after creation. Allowed: `NONE, DESTINATION_NOT_FOUND, ACCESS_DENIED`
`errorMessage`	string	—	ResolverQueryLogConfigAssociationErrorMessage Read-only: reported by AWS after creation.
`id`	string	—	Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	ResolverQueryLogConfigAssociationStatus Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, ACTION_NEEDED, DELETING, FAILED, OVERRIDDEN`

Route53ResolverResolverRuleAssociation # CLOUD CONTROL · AWS::Route53Resolver::ResolverRuleAssociation

Route53ResolverResolverRuleAssociation manages AWS::Route53Resolver::ResolverRuleAssociation through the AWS Cloud Control API.

kubectl get route53resolverresolverruleassociations · example on GitHub

Example

# Route53ResolverResolverRuleAssociation — Route 53 Resolver
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/route53resolver.html#route53resolverresolverruleassociation
apiVersion: aws.konfig.io/v1alpha1
kind: Route53ResolverResolverRuleAssociation
metadata:
  name: example-route53resolverresolverruleassociation
  namespace: default
spec:
  name: example-route53resolverresolverruleassociation
  providerRef:
    name: example-route53resolverresolverruleassociation
    region: us-east-1
  resolverRuleId: example-id
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`name`	string	—	The name of an association between a Resolver rule and a VPC.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resolverRuleId`	string	yes	The ID of the Resolver rule that you associated with the VPC that is specified by ``VPCId``.
`vpcId`	string	yes	The ID of the VPC that you associated the Resolver rule with.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resolverRuleAssociationId`	string	—	Read-only: reported by AWS after creation.