envoy.yaml

static_resources:
  listeners:
  - name: "127.0.0.1"
    address:
      socket_address:
        address: "0.0.0.0"
        protocol: TCP
        port_value: 9902
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          codec_type: AUTO
          idle_timeout: 840s
          stat_prefix: egress_dynamodb_iad
          #update access_logs here
          route_config:
            virtual_hosts:
            - name: egress_dynamodb_iad
              domains:
              - "*"
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: egress_dynamodb_iad
                  retry_policy:
                    retry_on: connect-failure
          http_filters:
          - name: envoy.http_dynamo_filter
            config: {}
          - name: envoy.router
            config: {}
          access_log:
          - name: envoy.file_access_log
            filter:
              or_filter:
                filters:
                  - status_code_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 400
                          runtime_key: access_log.access_error.status
                  - status_code_filter:
                      comparison:
                        op: EQ
                        value:
                          default_value: 0
                          runtime_key: access_log.access_error.status
                  - duration_filter:
                      comparison:
                        op: GE
                        value:
                          default_value: 2000
                          runtime_key: access_log.access_error.duration
            config:
              path: "/var/log/envoy/egress_dynamodb_iad_http_error.log"
              format: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH):256% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% \"%REQ(X-FORWARDED-FOR)%\" \"%REQ(USER-AGENT)%\" \"%REQ(X-REQUEST-ID)%\" \"%REQ(:AUTHORITY)%\" \"%UPSTREAM_HOST%\" \"%RESP(X-AMZN-RequestId)%\"\n"

  clusters:
  - name: egress_dynamodb_iad
    tls_context:
      common_tls_context:
        validation_context:
          trusted_ca:
            filename: certs/cacert.pem
          verify_subject_alt_name: "['dynamodb.us-east-1.amazonaws.com']"
    connect_timeout: 1s
    type: LOGICAL_DNS
    lb_policy: ROUND_ROBIN
    hosts:
    - socket_address:
        address: dynamodb.us-east-1.amazonaws.com
        port_value: 443
        protocol: TCP

cluster_manager: {}
flags_path: "/etc/envoy/flags"
watchdog: {}

admin:
  access_log_path: /var/log/envoy/admin_access.log
  address:
    socket_address:
      protocol: TCP
      address: 0.0.0.0
      port_value: 9901