Log DNS queries made in our VPC

[AntoineAugusti]

To prepare #255

Log DNS queries made in our VPC to a CloudWatch Logs log group for auditing purposes and before only allowing some queries. We can do this for our own VPC

notification-terraform/aws/common/vpc.tf

Lines 9 to 17 in a2b6dba

	resource "aws_vpc" "notification-canada-ca" {
	cidr_block = "10.0.0.0/16"
	enable_dns_hostnames = true
	tags = {
	Name = "notification-canada-ca"
	CostCenter = "notification-canada-ca-${var.env}"
	}
	}

You can create a new log group for this, and keep a retention of 2-3 weeks only. Asked the AWS support if we need to give some IAM permissions (waiting for an answer).

Ressources to look at:

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_query_log_config
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_query_log_config_association
• AWS documentation: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs.html
• AWS blog post: https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/

[AntoineAugusti]

Fixed in #266 by @jimleroyer