aws-cdk-lib 2.200.2__py3-none-any.whl → 2.224.0__py3-none-any.whl

aws_cdk/aws_route53resolver/__init__.py

@@ -73,9 +73,33 @@ from .. import (
     TagManager as _TagManager_0a598cb3,
     TreeInspector as _TreeInspector_488e0dd5,
 )
+from ..interfaces.aws_route53resolver import (
+    FirewallDomainListReference as _FirewallDomainListReference_e9058cb4,
+    FirewallRuleGroupAssociationReference as _FirewallRuleGroupAssociationReference_6387d2f8,
+    FirewallRuleGroupReference as _FirewallRuleGroupReference_4ee399b6,
+    IFirewallDomainListRef as _IFirewallDomainListRef_cbc42ba0,
+    IFirewallRuleGroupAssociationRef as _IFirewallRuleGroupAssociationRef_119e1744,
+    IFirewallRuleGroupRef as _IFirewallRuleGroupRef_9a321ea2,
+    IOutpostResolverRef as _IOutpostResolverRef_52fa5f66,
+    IResolverConfigRef as _IResolverConfigRef_1d384f7e,
+    IResolverDNSSECConfigRef as _IResolverDNSSECConfigRef_f032dbfa,
+    IResolverEndpointRef as _IResolverEndpointRef_afa17ae0,
+    IResolverQueryLoggingConfigAssociationRef as _IResolverQueryLoggingConfigAssociationRef_6173eaa8,
+    IResolverQueryLoggingConfigRef as _IResolverQueryLoggingConfigRef_d0f8733d,
+    IResolverRuleAssociationRef as _IResolverRuleAssociationRef_7d552f57,
+    IResolverRuleRef as _IResolverRuleRef_9606d452,
+    OutpostResolverReference as _OutpostResolverReference_b3441ad6,
+    ResolverConfigReference as _ResolverConfigReference_b614e5ee,
+    ResolverDNSSECConfigReference as _ResolverDNSSECConfigReference_a2a8fdc3,
+    ResolverEndpointReference as _ResolverEndpointReference_8c08ddc9,
+    ResolverQueryLoggingConfigAssociationReference as _ResolverQueryLoggingConfigAssociationReference_62d988ea,
+    ResolverQueryLoggingConfigReference as _ResolverQueryLoggingConfigReference_91966a96,
+    ResolverRuleAssociationReference as _ResolverRuleAssociationReference_875466c4,
+    ResolverRuleReference as _ResolverRuleReference_7e3f31e4,
+)
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IFirewallDomainListRef_cbc42ba0, _ITaggable_36806126)
 class CfnFirewallDomainList(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -116,7 +140,8 @@ class CfnFirewallDomainList(
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::FirewallDomainList``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param domain_file_url: The fully qualified URL or URI of the file stored in Amazon Simple Storage Service (Amazon S3) that contains the list of domains to import. The file must be in an S3 bucket that's in the same Region as your DNS Firewall. The file must be a text file and must contain a single domain per line.
@@ -254,6 +279,12 @@ class CfnFirewallDomainList(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="firewallDomainListRef")
+    def firewall_domain_list_ref(self) -> _FirewallDomainListReference_e9058cb4:
+        '''A reference to a FirewallDomainList resource.'''
+        return typing.cast(_FirewallDomainListReference_e9058cb4, jsii.get(self, "firewallDomainListRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -424,7 +455,7 @@ class CfnFirewallDomainListProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IFirewallRuleGroupRef_9a321ea2, _ITaggable_36806126)
 class CfnFirewallRuleGroup(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -478,7 +509,8 @@ class CfnFirewallRuleGroup(
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::FirewallRuleGroup``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param firewall_rules: A list of the rules that you have defined.
@@ -626,6 +658,12 @@ class CfnFirewallRuleGroup(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="firewallRuleGroupRef")
+    def firewall_rule_group_ref(self) -> _FirewallRuleGroupReference_4ee399b6:
+        '''A reference to a FirewallRuleGroup resource.'''
+        return typing.cast(_FirewallRuleGroupReference_4ee399b6, jsii.get(self, "firewallRuleGroupRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -964,7 +1002,7 @@ class CfnFirewallRuleGroup(
             )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IFirewallRuleGroupAssociationRef_119e1744, _ITaggable_36806126)
 class CfnFirewallRuleGroupAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1009,7 +1047,8 @@ class CfnFirewallRuleGroupAssociation(
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::FirewallRuleGroupAssociation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param firewall_rule_group_id: The unique identifier of the firewall rule group.
@@ -1145,6 +1184,14 @@ class CfnFirewallRuleGroupAssociation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="firewallRuleGroupAssociationRef")
+    def firewall_rule_group_association_ref(
+        self,
+    ) -> _FirewallRuleGroupAssociationReference_6387d2f8:
+        '''A reference to a FirewallRuleGroupAssociation resource.'''
+        return typing.cast(_FirewallRuleGroupAssociationReference_6387d2f8, jsii.get(self, "firewallRuleGroupAssociationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -1486,7 +1533,7 @@ class CfnFirewallRuleGroupProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IOutpostResolverRef_52fa5f66, _ITaggableV2_4e6798f8)
 class CfnOutpostResolver(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1529,7 +1576,8 @@ class CfnOutpostResolver(
         instance_count: typing.Optional[jsii.Number] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::OutpostResolver``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: Name of the Resolver.
@@ -1660,6 +1708,12 @@ class CfnOutpostResolver(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="outpostResolverRef")
+    def outpost_resolver_ref(self) -> _OutpostResolverReference_b3441ad6:
+        '''A reference to a OutpostResolver resource.'''
+        return typing.cast(_OutpostResolverReference_b3441ad6, jsii.get(self, "outpostResolverRef"))
+
     @builtins.property
     @jsii.member(jsii_name="name")
     def name(self) -> builtins.str:
@@ -1856,7 +1910,7 @@ class CfnOutpostResolverProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResolverConfigRef_1d384f7e)
 class CfnResolverConfig(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1888,7 +1942,8 @@ class CfnResolverConfig(
         autodefined_reverse_flag: builtins.str,
         resource_id: builtins.str,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverConfig``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param autodefined_reverse_flag: Represents the desired status of ``AutodefinedReverse`` . The only supported value on creation is ``DISABLE`` . Deletion of this resource will return ``AutodefinedReverse`` to its default value of ``ENABLED`` .
@@ -1904,6 +1959,27 @@ class CfnResolverConfig(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="fromResourceId")
+    @builtins.classmethod
+    def from_resource_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        resource_id: builtins.str,
+    ) -> _IResolverConfigRef_1d384f7e:
+        '''Creates a new IResolverConfigRef from a resourceId.
+
+        :param scope: -
+        :param id: -
+        :param resource_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f8f6b0479da60df4a0222dc8fed87ef1041d1b88f7275f1bdc7b538b75cb68aa)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
+        return typing.cast(_IResolverConfigRef_1d384f7e, jsii.sinvoke(cls, "fromResourceId", [scope, id, resource_id]))
+
     @jsii.member(jsii_name="inspect")
     def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
         '''Examines the CloudFormation resource and discloses attributes.
@@ -1968,6 +2044,12 @@ class CfnResolverConfig(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverConfigRef")
+    def resolver_config_ref(self) -> _ResolverConfigReference_b614e5ee:
+        '''A reference to a ResolverConfig resource.'''
+        return typing.cast(_ResolverConfigReference_b614e5ee, jsii.get(self, "resolverConfigRef"))
+
     @builtins.property
     @jsii.member(jsii_name="autodefinedReverseFlag")
     def autodefined_reverse_flag(self) -> builtins.str:
@@ -2072,7 +2154,7 @@ class CfnResolverConfigProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResolverDNSSECConfigRef_f032dbfa)
 class CfnResolverDNSSECConfig(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2102,7 +2184,8 @@ class CfnResolverDNSSECConfig(
         *,
         resource_id: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverDNSSECConfig``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resource_id: The ID of the virtual private cloud (VPC) that you're configuring the DNSSEC validation status for.
@@ -2183,6 +2266,12 @@ class CfnResolverDNSSECConfig(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverDnssecConfigRef")
+    def resolver_dnssec_config_ref(self) -> _ResolverDNSSECConfigReference_a2a8fdc3:
+        '''A reference to a ResolverDNSSECConfig resource.'''
+        return typing.cast(_ResolverDNSSECConfigReference_a2a8fdc3, jsii.get(self, "resolverDnssecConfigRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resourceId")
     def resource_id(self) -> typing.Optional[builtins.str]:
@@ -2249,7 +2338,7 @@ class CfnResolverDNSSECConfigProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IResolverEndpointRef_afa17ae0, _ITaggable_36806126)
 class CfnResolverEndpoint(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2314,16 +2403,17 @@ class CfnResolverEndpoint(
         resolver_endpoint_type: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverEndpoint``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param direction: Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:. - ``INBOUND`` : allows DNS queries to your VPC from your network - ``OUTBOUND`` : allows DNS queries from your VPC to your network
+        :param direction: Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:. - ``INBOUND`` : allows DNS queries to your VPC from your network - ``OUTBOUND`` : allows DNS queries from your VPC to your network - ``INBOUND_DELEGATION`` : Resolver delegates queries to Route 53 private hosted zones from your network.
         :param ip_addresses: The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). The subnet ID uniquely identifies a VPC. .. epigraph:: Even though the minimum is 1, Route 53 requires that you create at least two.
         :param security_group_ids: The ID of one or more security groups that control access to this VPC. The security group must include one or more inbound rules (for inbound endpoints) or outbound rules (for outbound endpoints). Inbound and outbound rules must allow TCP and UDP access. For inbound access, open port 53. For outbound access, open the port that you're using for DNS queries on your network.
         :param name: A friendly name that lets you easily find a configuration in the Resolver dashboard in the Route 53 console.
         :param outpost_arn: The ARN (Amazon Resource Name) for the Outpost.
         :param preferred_instance_type: The Amazon EC2 instance type.
-        :param protocols: Protocols used for the endpoint. DoH-FIPS is applicable for inbound endpoints only. For an inbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 and DoH-FIPS in combination. - Do53 alone. - DoH alone. - DoH-FIPS alone. - None, which is treated as Do53. For an outbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 alone. - DoH alone. - None, which is treated as Do53.
+        :param protocols: Protocols used for the endpoint. DoH-FIPS is applicable for a default inbound endpoints only. For an inbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 and DoH-FIPS in combination. - Do53 alone. - DoH alone. - DoH-FIPS alone. - None, which is treated as Do53. For a delegation inbound endpoint you can use Do53 only. For an outbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 alone. - DoH alone. - None, which is treated as Do53.
         :param resolver_endpoint_type: The Resolver endpoint IP address type.
         :param tags: Route 53 Resolver doesn't support updating tags through CloudFormation.
         '''
@@ -2458,6 +2548,12 @@ class CfnResolverEndpoint(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverEndpointRef")
+    def resolver_endpoint_ref(self) -> _ResolverEndpointReference_8c08ddc9:
+        '''A reference to a ResolverEndpoint resource.'''
+        return typing.cast(_ResolverEndpointReference_8c08ddc9, jsii.get(self, "resolverEndpointRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -2552,7 +2648,7 @@ class CfnResolverEndpoint(
     def protocols(self) -> typing.Optional[typing.List[builtins.str]]:
         '''Protocols used for the endpoint.
 
-        DoH-FIPS is applicable for inbound endpoints only.
+        DoH-FIPS is applicable for a default inbound endpoints only.
         '''
         return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "protocols"))
 
@@ -2709,13 +2805,13 @@ class CfnResolverEndpointProps:
     ) -> None:
         '''Properties for defining a ``CfnResolverEndpoint``.
 
-        :param direction: Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:. - ``INBOUND`` : allows DNS queries to your VPC from your network - ``OUTBOUND`` : allows DNS queries from your VPC to your network
+        :param direction: Indicates whether the Resolver endpoint allows inbound or outbound DNS queries:. - ``INBOUND`` : allows DNS queries to your VPC from your network - ``OUTBOUND`` : allows DNS queries from your VPC to your network - ``INBOUND_DELEGATION`` : Resolver delegates queries to Route 53 private hosted zones from your network.
         :param ip_addresses: The subnets and IP addresses in your VPC that DNS queries originate from (for outbound endpoints) or that you forward DNS queries to (for inbound endpoints). The subnet ID uniquely identifies a VPC. .. epigraph:: Even though the minimum is 1, Route 53 requires that you create at least two.
         :param security_group_ids: The ID of one or more security groups that control access to this VPC. The security group must include one or more inbound rules (for inbound endpoints) or outbound rules (for outbound endpoints). Inbound and outbound rules must allow TCP and UDP access. For inbound access, open port 53. For outbound access, open the port that you're using for DNS queries on your network.
         :param name: A friendly name that lets you easily find a configuration in the Resolver dashboard in the Route 53 console.
         :param outpost_arn: The ARN (Amazon Resource Name) for the Outpost.
         :param preferred_instance_type: The Amazon EC2 instance type.
-        :param protocols: Protocols used for the endpoint. DoH-FIPS is applicable for inbound endpoints only. For an inbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 and DoH-FIPS in combination. - Do53 alone. - DoH alone. - DoH-FIPS alone. - None, which is treated as Do53. For an outbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 alone. - DoH alone. - None, which is treated as Do53.
+        :param protocols: Protocols used for the endpoint. DoH-FIPS is applicable for a default inbound endpoints only. For an inbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 and DoH-FIPS in combination. - Do53 alone. - DoH alone. - DoH-FIPS alone. - None, which is treated as Do53. For a delegation inbound endpoint you can use Do53 only. For an outbound endpoint you can apply the protocols as follows: - Do53 and DoH in combination. - Do53 alone. - DoH alone. - None, which is treated as Do53.
         :param resolver_endpoint_type: The Resolver endpoint IP address type.
         :param tags: Route 53 Resolver doesn't support updating tags through CloudFormation.
 
@@ -2786,6 +2882,7 @@ class CfnResolverEndpointProps:
 
         - ``INBOUND`` : allows DNS queries to your VPC from your network
         - ``OUTBOUND`` : allows DNS queries from your VPC to your network
+        - ``INBOUND_DELEGATION`` : Resolver delegates queries to Route 53 private hosted zones from your network.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverendpoint.html#cfn-route53resolver-resolverendpoint-direction
         '''
@@ -2851,7 +2948,7 @@ class CfnResolverEndpointProps:
 
     @builtins.property
     def protocols(self) -> typing.Optional[typing.List[builtins.str]]:
-        '''Protocols used for the endpoint. DoH-FIPS is applicable for inbound endpoints only.
+        '''Protocols used for the endpoint. DoH-FIPS is applicable for a default inbound endpoints only.
 
         For an inbound endpoint you can apply the protocols as follows:
 
@@ -2862,6 +2959,8 @@ class CfnResolverEndpointProps:
         - DoH-FIPS alone.
         - None, which is treated as Do53.
 
+        For a delegation inbound endpoint you can use Do53 only.
+
         For an outbound endpoint you can apply the protocols as follows:
 
         - Do53 and DoH in combination.
@@ -2904,7 +3003,7 @@ class CfnResolverEndpointProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+@jsii.implements(_IInspectable_c2943556, _IResolverQueryLoggingConfigRef_d0f8733d, _ITaggableV2_4e6798f8)
 class CfnResolverQueryLoggingConfig(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -2941,7 +3040,8 @@ class CfnResolverQueryLoggingConfig(
         name: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverQueryLoggingConfig``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param destination_arn: The ARN of the resource that you want Resolver to send query logs: an Amazon S3 bucket, a CloudWatch Logs log group, or a Kinesis Data Firehose delivery stream.
@@ -3082,6 +3182,14 @@ class CfnResolverQueryLoggingConfig(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverQueryLoggingConfigRef")
+    def resolver_query_logging_config_ref(
+        self,
+    ) -> _ResolverQueryLoggingConfigReference_91966a96:
+        '''A reference to a ResolverQueryLoggingConfig resource.'''
+        return typing.cast(_ResolverQueryLoggingConfigReference_91966a96, jsii.get(self, "resolverQueryLoggingConfigRef"))
+
     @builtins.property
     @jsii.member(jsii_name="destinationArn")
     def destination_arn(self) -> typing.Optional[builtins.str]:
@@ -3122,7 +3230,7 @@ class CfnResolverQueryLoggingConfig(
         jsii.set(self, "tags", value) # pyright: ignore[reportArgumentType]
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResolverQueryLoggingConfigAssociationRef_6173eaa8)
 class CfnResolverQueryLoggingConfigAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3156,7 +3264,8 @@ class CfnResolverQueryLoggingConfigAssociation(
         resolver_query_log_config_id: typing.Optional[builtins.str] = None,
         resource_id: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverQueryLoggingConfigAssociation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resolver_query_log_config_id: The ID of the query logging configuration that a VPC is associated with.
@@ -3265,6 +3374,14 @@ class CfnResolverQueryLoggingConfigAssociation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverQueryLoggingConfigAssociationRef")
+    def resolver_query_logging_config_association_ref(
+        self,
+    ) -> _ResolverQueryLoggingConfigAssociationReference_62d988ea:
+        '''A reference to a ResolverQueryLoggingConfigAssociation resource.'''
+        return typing.cast(_ResolverQueryLoggingConfigAssociationReference_62d988ea, jsii.get(self, "resolverQueryLoggingConfigAssociationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resolverQueryLogConfigId")
     def resolver_query_log_config_id(self) -> typing.Optional[builtins.str]:
@@ -3458,7 +3575,7 @@ class CfnResolverQueryLoggingConfigProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
+@jsii.implements(_IInspectable_c2943556, _IResolverRuleRef_9606d452, _ITaggable_36806126)
 class CfnResolverRule(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3480,6 +3597,7 @@ class CfnResolverRule(
             rule_type="ruleType",
         
             # the properties below are optional
+            delegation_record="delegationRecord",
             domain_name="domainName",
             name="name",
             resolver_endpoint_id="resolverEndpointId",
@@ -3503,18 +3621,21 @@ class CfnResolverRule(
         id: builtins.str,
         *,
         rule_type: builtins.str,
+        delegation_record: typing.Optional[builtins.str] = None,
         domain_name: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         resolver_endpoint_id: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         target_ips: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResolverRule.TargetAddressProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverRule``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param rule_type: When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` . When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify ``SYSTEM`` . For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify ``FORWARD`` for ``RuleType`` . To then have Resolver process queries for apex.example.com, you create a rule and specify ``SYSTEM`` for ``RuleType`` . Currently, only Resolver can create rules that have a value of ``RECURSIVE`` for ``RuleType`` .
+        :param rule_type: When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` or ``DELEGATE`` . If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com). When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify ``SYSTEM`` . For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify ``FORWARD`` for ``RuleType`` . To then have Resolver process queries for apex.example.com, you create a rule and specify ``SYSTEM`` for ``RuleType`` . Currently, only Resolver can create rules that have a value of ``RECURSIVE`` for ``RuleType`` .
+        :param delegation_record: DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.
         :param domain_name: DNS queries for this domain name are forwarded to the IP addresses that are specified in ``TargetIps`` . If a query matches multiple Resolver rules (example.com and www.example.com), the query is routed using the Resolver rule that contains the most specific domain name (www.example.com).
-        :param name: The name for the Resolver rule, which you specified when you created the Resolver rule.
+        :param name: The name for the Resolver rule, which you specified when you created the Resolver rule. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
         :param resolver_endpoint_id: The ID of the endpoint that the rule is associated with.
         :param tags: Tags help organize and categorize your Resolver rules. Each tag consists of a key and an optional value, both of which you define.
         :param target_ips: An array that contains the IP addresses and ports that an outbound endpoint forwards DNS queries to. Typically, these are the IP addresses of DNS resolvers on your network.
@@ -3525,6 +3646,7 @@ class CfnResolverRule(
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
         props = CfnResolverRuleProps(
             rule_type=rule_type,
+            delegation_record=delegation_record,
             domain_name=domain_name,
             name=name,
             resolver_endpoint_id=resolver_endpoint_id,
@@ -3620,6 +3742,8 @@ class CfnResolverRule(
 
         This value isn't applicable when ``RuleType`` is ``SYSTEM`` .
 
+        ``TargetIps`` is available only when the value of ``RuleType`` is ``FORWARD`` . You should not provide ``TargetIps`` when the ``RuleType`` is ``DELEGATE`` .
+
         :cloudformationAttribute: TargetIps
         '''
         return typing.cast(_IResolvable_da3f097b, jsii.get(self, "attrTargetIps"))
@@ -3629,6 +3753,12 @@ class CfnResolverRule(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverRuleRef")
+    def resolver_rule_ref(self) -> _ResolverRuleReference_7e3f31e4:
+        '''A reference to a ResolverRule resource.'''
+        return typing.cast(_ResolverRuleReference_7e3f31e4, jsii.get(self, "resolverRuleRef"))
+
     @builtins.property
     @jsii.member(jsii_name="tags")
     def tags(self) -> _TagManager_0a598cb3:
@@ -3638,7 +3768,7 @@ class CfnResolverRule(
     @builtins.property
     @jsii.member(jsii_name="ruleType")
     def rule_type(self) -> builtins.str:
-        '''When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` .'''
+        '''When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` or ``DELEGATE`` .'''
         return typing.cast(builtins.str, jsii.get(self, "ruleType"))
 
     @rule_type.setter
@@ -3648,6 +3778,19 @@ class CfnResolverRule(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "ruleType", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="delegationRecord")
+    def delegation_record(self) -> typing.Optional[builtins.str]:
+        '''DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "delegationRecord"))
+
+    @delegation_record.setter
+    def delegation_record(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b1126d07ce449d0d6220e3fbf183f2d786e81574a4f131914dfe0914a55bb851)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "delegationRecord", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="domainName")
     def domain_name(self) -> typing.Optional[builtins.str]:
@@ -3844,7 +3987,7 @@ class CfnResolverRule(
             )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _IResolverRuleAssociationRef_7d552f57)
 class CfnResolverRuleAssociation(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -3880,12 +4023,13 @@ class CfnResolverRuleAssociation(
         vpc_id: builtins.str,
         name: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''
+        '''Create a new ``AWS::Route53Resolver::ResolverRuleAssociation``.
+
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param resolver_rule_id: The ID of the Resolver rule that you associated with the VPC that is specified by ``VPCId`` .
         :param vpc_id: The ID of the VPC that you associated the Resolver rule with.
-        :param name: The name of an association between a Resolver rule and a VPC.
+        :param name: The name of an association between a Resolver rule and a VPC. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__8e372f7e2d960601c8b6496b7cbefaf56be2402644532349feb6b1a788f12a6f)
@@ -3968,6 +4112,14 @@ class CfnResolverRuleAssociation(
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
+    @builtins.property
+    @jsii.member(jsii_name="resolverRuleAssociationRef")
+    def resolver_rule_association_ref(
+        self,
+    ) -> _ResolverRuleAssociationReference_875466c4:
+        '''A reference to a ResolverRuleAssociation resource.'''
+        return typing.cast(_ResolverRuleAssociationReference_875466c4, jsii.get(self, "resolverRuleAssociationRef"))
+
     @builtins.property
     @jsii.member(jsii_name="resolverRuleId")
     def resolver_rule_id(self) -> builtins.str:
@@ -4029,7 +4181,7 @@ class CfnResolverRuleAssociationProps:
 
         :param resolver_rule_id: The ID of the Resolver rule that you associated with the VPC that is specified by ``VPCId`` .
         :param vpc_id: The ID of the VPC that you associated the Resolver rule with.
-        :param name: The name of an association between a Resolver rule and a VPC.
+        :param name: The name of an association between a Resolver rule and a VPC. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverruleassociation.html
         :exampleMetadata: fixture=_generated
@@ -4084,6 +4236,8 @@ class CfnResolverRuleAssociationProps:
     def name(self) -> typing.Optional[builtins.str]:
         '''The name of an association between a Resolver rule and a VPC.
 
+        The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverruleassociation.html#cfn-route53resolver-resolverruleassociation-name
         '''
         result = self._values.get("name")
@@ -4106,6 +4260,7 @@ class CfnResolverRuleAssociationProps:
     jsii_struct_bases=[],
     name_mapping={
         "rule_type": "ruleType",
+        "delegation_record": "delegationRecord",
         "domain_name": "domainName",
         "name": "name",
         "resolver_endpoint_id": "resolverEndpointId",
@@ -4118,6 +4273,7 @@ class CfnResolverRuleProps:
         self,
         *,
         rule_type: builtins.str,
+        delegation_record: typing.Optional[builtins.str] = None,
         domain_name: typing.Optional[builtins.str] = None,
         name: typing.Optional[builtins.str] = None,
         resolver_endpoint_id: typing.Optional[builtins.str] = None,
@@ -4126,9 +4282,10 @@ class CfnResolverRuleProps:
     ) -> None:
         '''Properties for defining a ``CfnResolverRule``.
 
-        :param rule_type: When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` . When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify ``SYSTEM`` . For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify ``FORWARD`` for ``RuleType`` . To then have Resolver process queries for apex.example.com, you create a rule and specify ``SYSTEM`` for ``RuleType`` . Currently, only Resolver can create rules that have a value of ``RECURSIVE`` for ``RuleType`` .
+        :param rule_type: When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` or ``DELEGATE`` . If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com). When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify ``SYSTEM`` . For example, to forward DNS queries for example.com to resolvers on your network, you create a rule and specify ``FORWARD`` for ``RuleType`` . To then have Resolver process queries for apex.example.com, you create a rule and specify ``SYSTEM`` for ``RuleType`` . Currently, only Resolver can create rules that have a value of ``RECURSIVE`` for ``RuleType`` .
+        :param delegation_record: DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.
         :param domain_name: DNS queries for this domain name are forwarded to the IP addresses that are specified in ``TargetIps`` . If a query matches multiple Resolver rules (example.com and www.example.com), the query is routed using the Resolver rule that contains the most specific domain name (www.example.com).
-        :param name: The name for the Resolver rule, which you specified when you created the Resolver rule.
+        :param name: The name for the Resolver rule, which you specified when you created the Resolver rule. The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
         :param resolver_endpoint_id: The ID of the endpoint that the rule is associated with.
         :param tags: Tags help organize and categorize your Resolver rules. Each tag consists of a key and an optional value, both of which you define.
         :param target_ips: An array that contains the IP addresses and ports that an outbound endpoint forwards DNS queries to. Typically, these are the IP addresses of DNS resolvers on your network.
@@ -4146,6 +4303,7 @@ class CfnResolverRuleProps:
                 rule_type="ruleType",
             
                 # the properties below are optional
+                delegation_record="delegationRecord",
                 domain_name="domainName",
                 name="name",
                 resolver_endpoint_id="resolverEndpointId",
@@ -4165,6 +4323,7 @@ class CfnResolverRuleProps:
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fdcaea1870aaf2dc13fe56b2d15a89d6adba2ad5884071fc618c9e4bb2c3ddec)
             check_type(argname="argument rule_type", value=rule_type, expected_type=type_hints["rule_type"])
+            check_type(argname="argument delegation_record", value=delegation_record, expected_type=type_hints["delegation_record"])
             check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument resolver_endpoint_id", value=resolver_endpoint_id, expected_type=type_hints["resolver_endpoint_id"])
@@ -4173,6 +4332,8 @@ class CfnResolverRuleProps:
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "rule_type": rule_type,
         }
+        if delegation_record is not None:
+            self._values["delegation_record"] = delegation_record
         if domain_name is not None:
             self._values["domain_name"] = domain_name
         if name is not None:
@@ -4186,7 +4347,9 @@ class CfnResolverRuleProps:
 
     @builtins.property
     def rule_type(self) -> builtins.str:
-        '''When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` .
+        '''When you want to forward DNS queries for specified domain name to resolvers on your network, specify ``FORWARD`` or ``DELEGATE`` .
+
+        If a query matches multiple Resolver rules (example.com and www.example.com), outbound DNS queries are routed using the Resolver rule that contains the most specific domain name (www.example.com).
 
         When you have a forwarding rule to forward DNS queries for a domain to your network and you want Resolver to process queries for a subdomain of that domain, specify ``SYSTEM`` .
 
@@ -4200,6 +4363,15 @@ class CfnResolverRuleProps:
         assert result is not None, "Required property 'rule_type' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def delegation_record(self) -> typing.Optional[builtins.str]:
+        '''DNS queries with delegation records that point to this domain name are forwarded to resolvers on your network.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverrule.html#cfn-route53resolver-resolverrule-delegationrecord
+        '''
+        result = self._values.get("delegation_record")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def domain_name(self) -> typing.Optional[builtins.str]:
         '''DNS queries for this domain name are forwarded to the IP addresses that are specified in ``TargetIps`` .
@@ -4215,6 +4387,8 @@ class CfnResolverRuleProps:
     def name(self) -> typing.Optional[builtins.str]:
         '''The name for the Resolver rule, which you specified when you created the Resolver rule.
 
+        The name can be up to 64 characters long and can contain letters (a-z, A-Z), numbers (0-9), hyphens (-), underscores (_), and spaces. The name cannot consist of only numbers.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53resolver-resolverrule.html#cfn-route53resolver-resolverrule-name
         '''
         result = self._values.get("name")
@@ -4568,6 +4742,14 @@ def _typecheckingstub__35122d782a5f80846e3948e7eb0337b124eee2f562394f9f0ac3811b7
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__f8f6b0479da60df4a0222dc8fed87ef1041d1b88f7275f1bdc7b538b75cb68aa(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    resource_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b9b80f7dd8c3634834446059b6a5647da70f751aee16fc635988309e2b114da8(
     inspector: _TreeInspector_488e0dd5,
 ) -> None:
@@ -4838,6 +5020,7 @@ def _typecheckingstub__7253810e416357d129df95b3c7aa9aa0f08e68de7d465658e598912cf
     id: builtins.str,
     *,
     rule_type: builtins.str,
+    delegation_record: typing.Optional[builtins.str] = None,
     domain_name: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     resolver_endpoint_id: typing.Optional[builtins.str] = None,
@@ -4865,6 +5048,12 @@ def _typecheckingstub__13530a5c4f7ce175ae03b85dc7d4550ae7a3cb68cb2be12c89a167e8d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__b1126d07ce449d0d6220e3fbf183f2d786e81574a4f131914dfe0914a55bb851(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__3e83136a81b10aed2481c602cdca3f63e1c2bcaed82fe69b1ab2413af7c0b7c0(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -4959,6 +5148,7 @@ def _typecheckingstub__3b7cd1048ae30851b3480dc04a365c7bd487212f9328f80bc61e1bae1
 def _typecheckingstub__fdcaea1870aaf2dc13fe56b2d15a89d6adba2ad5884071fc618c9e4bb2c3ddec(
     *,
     rule_type: builtins.str,
+    delegation_record: typing.Optional[builtins.str] = None,
     domain_name: typing.Optional[builtins.str] = None,
     name: typing.Optional[builtins.str] = None,
     resolver_endpoint_id: typing.Optional[builtins.str] = None,