1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# 미국 동부와 유럽 리전에 배포된 애플리케이션을 위한 지연 시간 기반 레코드 생성
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1D633PJN98FT9 \
  --change-batch '{
    "Changes": [
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "app.example.com",
          "Type": "A",
          "SetIdentifier": "us-east-1",
          "Region": "us-east-1",
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "54.236.178.210"
            }
          ]
        }
      },
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "app.example.com",
          "Type": "A",
          "SetIdentifier": "eu-west-1",
          "Region": "eu-west-1",
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "34.241.138.23"
            }
          ]
        }
      }
    ]
  }'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# 새 버전으로 트래픽을 점진적으로 이동하는 가중치 기반 레코드
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1D633PJN98FT9 \
  --change-batch '{
    "Changes": [
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "www.example.com",
          "Type": "A",
          "SetIdentifier": "version-1",
          "Weight": 80,
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "192.0.2.1"
            }
          ]
        }
      },
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "www.example.com",
          "Type": "A",
          "SetIdentifier": "version-2",
          "Weight": 20,
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "192.0.2.2"
            }
          ]
        }
      }
    ]
  }'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# 글로벌 액셀러레이터 생성
aws globalaccelerator create-accelerator \
  --name my-global-app \
  --ip-address-type IPV4 \
  --enabled

# 리스너 생성
aws globalaccelerator create-listener \
  --accelerator-arn arn:aws:globalaccelerator::123456789012:accelerator/1234abcd-abcd-1234-abcd-1234abcdefgh \
  --port-ranges '[{"FromPort":80,"ToPort":80},{"FromPort":443,"ToPort":443}]' \
  --protocol TCP

# 여러 리전에 엔드포인트 그룹 추가
aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::123456789012:accelerator/1234abcd-abcd-1234-abcd-1234abcdefgh/listener/abcdef1234 \
  --endpoint-group-region us-east-1 \
  --endpoint-configurations '[{"EndpointId":"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-lb/1234567890abcdef"}]'

aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::123456789012:accelerator/1234abcd-abcd-1234-abcd-1234abcdefgh/listener/abcdef1234 \
  --endpoint-group-region ap-northeast-2 \
  --endpoint-configurations '[{"EndpointId":"arn:aws:elasticloadbalancing:ap-northeast-2:123456789012:loadbalancer/app/my-lb-seoul/0987654321abcdef"}]'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# 기본 엔드포인트에 대한 상태 확인 생성
aws route53 create-health-check \
  --caller-reference 2014-07-192 \
  --health-check-config '{
    "IPAddress": "192.0.2.1",
    "Port": 80,
    "Type": "HTTP",
    "ResourcePath": "/health",
    "FullyQualifiedDomainName": "primary.example.com",
    "RequestInterval": 30,
    "FailureThreshold": 3
  }'

# 장애 조치 레코드 구성 (기본)
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1D633PJN98FT9 \
  --change-batch '{
    "Changes": [
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "failover.example.com",
          "Type": "A",
          "SetIdentifier": "primary",
          "Failover": "PRIMARY",
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "192.0.2.1"
            }
          ],
          "HealthCheckId": "abcdef11-2222-3333-4444-555555fedcba"
        }
      },
      {
        "Action": "CREATE",
        "ResourceRecordSet": {
          "Name": "failover.example.com",
          "Type": "A",
          "SetIdentifier": "secondary",
          "Failover": "SECONDARY",
          "TTL": 60,
          "ResourceRecords": [
            {
              "Value": "192.0.2.2"
            }
          ]
        }
      }
    ]
  }'

1
2
3
4
5
6
7
8
9
10
# DNSSEC 활성화 (AWS CLI)
aws route53 enable-dnssec-signing \
  --hosted-zone-id Z1D633PJN98FT9

# KSK(Key Signing Key) 생성
aws route53 create-key-signing-key \
  --hosted-zone-id Z1D633PJN98FT9 \
  --key-name example-key \
  --status ACTIVE \
  --key-management-service-arn arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# DNS 방화벽 규칙 그룹 생성
aws route53resolver create-firewall-rule-group \
  --creator-request-id $(date +%s) \
  --name "BlockMaliciousDomains" \
  --tags Key=Environment,Value=Production

# 방화벽 규칙 추가
aws route53resolver create-firewall-rule \
  --creator-request-id $(date +%s) \
  --firewall-rule-group-id firewall-rule-group-id \
  --firewall-domain-list-id domain-list-id \
  --priority 100 \
  --action BLOCK \
  --name "BlockMalware"

1
2
3
4
5
6
7
8
9
10
# DNS 쿼리 로깅 활성화
aws route53resolver create-resolver-query-log-config \
  --name "dns-query-logging" \
  --destination-arn arn:aws:s3:::dns-query-logs-bucket \
  --creator-request-id $(date +%s)

# 쿼리 로그 구성을 VPC에 연결
aws route53resolver associate-resolver-query-log-config \
  --resolver-query-log-config-id rqlc-1234567890abcdef0 \
  --resource-id vpc-0ab1c2d34e5f67890