Skip to content

Commit d8d6816

Browse files
Kalindi-DevKalindi-Dev
authored
Merge branch 'main' into fix/168-align-cedar-engines
2 parents c5a2352 + bb7876a commit d8d6816

2 files changed

Lines changed: 56 additions & 14 deletions

File tree

‎docs/guides/DEPLOYMENT_GUIDE.md‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -177,13 +177,24 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
177177

178178
**Resolution — choose one:**
179179

180-
#### Option A: Manual disassociation via AWS Console (recommended)
180+
#### Option A: AWS CLI disassociation (recommended)
181181

182-
1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
183-
2. Select the query logging configuration named `agent-dns-query-log`
184-
3. Under **Associated VPCs**, disassociate the VPC
185-
4. Delete the query logging configuration
186-
5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
182+
Fastest, scriptable, no console access required. Replace `<vpc-id>` with the agent VPC ID and `<region>` with your stack's region.
183+
184+
1. List the association for your VPC to get the `ResolverQueryLogConfigId`:
185+
```bash
186+
aws route53resolver list-resolver-query-log-config-associations \
187+
--region <region> \
188+
--query "ResolverQueryLogConfigAssociations[?ResourceId=='<vpc-id>']"
189+
```
190+
2. Disassociate using the `Id` from step 1:
191+
```bash
192+
aws route53resolver disassociate-resolver-query-log-config \
193+
--resolver-query-log-config-id <rqlc-id> \
194+
--resource-id <vpc-id> \
195+
--region <region>
196+
```
197+
3. Run `mise //cdk:deploy` — CloudFormation recreates both the config and association without the orphan tags. The pre-existing `ResolverQueryLoggingConfig` is replaced as part of the same update, so an explicit `delete-resolver-query-log-config` is not required.
187198

188199
#### Option B: Two-phase deploy (comment-out / re-add)
189200

@@ -199,7 +210,17 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
199210
3. Uncomment the `DnsFirewall` block
200211
4. Deploy again: `mise //cdk:deploy` — resources are recreated cleanly without tags
201212

202-
Option B is more disruptive (two deploys, brief DNS logging gap) but requires no console access.
213+
Option B is more disruptive (two deploys, brief DNS logging gap) but requires no AWS API access beyond `cdk deploy`.
214+
215+
#### Option C: Manual disassociation via AWS Console
216+
217+
For users without AWS CLI access.
218+
219+
1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
220+
2. Select the query logging configuration named `agent-dns-query-log`
221+
3. Under **Associated VPCs**, disassociate the VPC
222+
4. Delete the query logging configuration
223+
5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
203224

204225
## Related docs
205226

‎docs/src/content/docs/getting-started/Deployment-guide.md‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -181,13 +181,24 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
181181

182182
**Resolution — choose one:**
183183

184-
#### Option A: Manual disassociation via AWS Console (recommended)
184+
#### Option A: AWS CLI disassociation (recommended)
185185

186-
1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
187-
2. Select the query logging configuration named `agent-dns-query-log`
188-
3. Under **Associated VPCs**, disassociate the VPC
189-
4. Delete the query logging configuration
190-
5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
186+
Fastest, scriptable, no console access required. Replace `<vpc-id>` with the agent VPC ID and `<region>` with your stack's region.
187+
188+
1. List the association for your VPC to get the `ResolverQueryLogConfigId`:
189+
```bash
190+
aws route53resolver list-resolver-query-log-config-associations \
191+
--region <region> \
192+
--query "ResolverQueryLogConfigAssociations[?ResourceId=='<vpc-id>']"
193+
```
194+
2. Disassociate using the `Id` from step 1:
195+
```bash
196+
aws route53resolver disassociate-resolver-query-log-config \
197+
--resolver-query-log-config-id <rqlc-id> \
198+
--resource-id <vpc-id> \
199+
--region <region>
200+
```
201+
3. Run `mise //cdk:deploy` — CloudFormation recreates both the config and association without the orphan tags. The pre-existing `ResolverQueryLoggingConfig` is replaced as part of the same update, so an explicit `delete-resolver-query-log-config` is not required.
191202

192203
#### Option B: Two-phase deploy (comment-out / re-add)
193204

@@ -203,7 +214,17 @@ Triggers via `workflow_run` when `build.yml` completes successfully. The pipelin
203214
3. Uncomment the `DnsFirewall` block
204215
4. Deploy again: `mise //cdk:deploy` — resources are recreated cleanly without tags
205216

206-
Option B is more disruptive (two deploys, brief DNS logging gap) but requires no console access.
217+
Option B is more disruptive (two deploys, brief DNS logging gap) but requires no AWS API access beyond `cdk deploy`.
218+
219+
#### Option C: Manual disassociation via AWS Console
220+
221+
For users without AWS CLI access.
222+
223+
1. Open the [Route 53 Resolver console](https://console.aws.amazon.com/route53resolver/home#/query-logging)
224+
2. Select the query logging configuration named `agent-dns-query-log`
225+
3. Under **Associated VPCs**, disassociate the VPC
226+
4. Delete the query logging configuration
227+
5. Run `mise //cdk:deploy` (or `cdk deploy`) — CloudFormation will recreate both resources without tags
207228

208229
## Related docs
209230

0 commit comments

Comments
 (0)