google_dns_managed_zone

A zone is a subtree of the DNS namespace under one administrative responsibility. A ManagedZone is a resource that represents a DNS zone hosted by the Cloud DNS service.

To get more information about ManagedZone, see:

Open in Cloud Shell

Example Usage - Dns Managed Zone Basic

resource "google_dns_managed_zone" "example-zone" {
  name        = "example-zone"
  dns_name    = "example-${random_id.rnd.hex}.com."
  description = "Example DNS zone"
  labels = {
    foo = "bar"
  }
}

resource "random_id" "rnd" {
  byte_length = 4
}
Open in Cloud Shell

Example Usage - Dns Managed Zone Private

resource "google_dns_managed_zone" "private-zone" {
  name        = "private-zone"
  dns_name    = "private.example.com."
  description = "Example private DNS zone"
  labels = {
    foo = "bar"
  }

  visibility = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.network-1.id
    }
    networks {
      network_url = google_compute_network.network-2.id
    }
  }
}

resource "google_compute_network" "network-1" {
  name                    = "network-1"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-2" {
  name                    = "network-2"
  auto_create_subnetworks = false
}
## Example Usage - Dns Managed Zone Private Forwarding
resource "google_dns_managed_zone" "private-zone" {
  name        = "private-zone"
  dns_name    = "private.example.com."
  description = "Example private DNS zone"
  labels = {
    foo = "bar"
  }

  visibility = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.network-1.id
    }
    networks {
      network_url = google_compute_network.network-2.id
    }
  }

  forwarding_config {
    target_name_servers {
      ipv4_address = "172.16.1.10"
    }
    target_name_servers {
      ipv4_address = "172.16.1.20"
    }
  }
}

resource "google_compute_network" "network-1" {
  name                    = "network-1"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-2" {
  name                    = "network-2"
  auto_create_subnetworks = false
}
Open in Cloud Shell

Example Usage - Dns Managed Zone Private Gke

resource "google_dns_managed_zone" "private-zone-gke" {
  name        = "private-zone"
  dns_name    = "private.example.com."
  description = "Example private DNS zone"
  labels = {
    foo = "bar"
  }

  visibility = "private"

  private_visibility_config {
    gke_clusters {
      gke_cluster_name = google_container_cluster.cluster-1.id
    }
  }
}

resource "google_compute_network" "network-1" {
  name                    = "network-1"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnetwork-1" {
  name                     = google_compute_network.network-1.name
  network                  = google_compute_network.network-1.name
  ip_cidr_range            = "10.0.36.0/24"
  region                   = "us-central1"
  private_ip_google_access = true

  secondary_ip_range {
    range_name    = "pod"
    ip_cidr_range = "10.0.0.0/19"
  }

  secondary_ip_range {
    range_name    = "svc"
    ip_cidr_range = "10.0.32.0/22"
  }
}

resource "google_container_cluster" "cluster-1" {
  name               = "cluster-1"
  location           = "us-central1-c"
  initial_node_count = 1

  networking_mode = "VPC_NATIVE"
  default_snat_status {
    disabled = true
  }
  network    = google_compute_network.network-1.name
  subnetwork = google_compute_subnetwork.subnetwork-1.name

  private_cluster_config {
    enable_private_endpoint = true
    enable_private_nodes    = true
    master_ipv4_cidr_block  = "10.42.0.0/28"
    master_global_access_config {
      enabled = true
    }
  }
  master_authorized_networks_config {
  }
  ip_allocation_policy {
    cluster_secondary_range_name  = google_compute_subnetwork.subnetwork-1.secondary_ip_range[0].range_name
    services_secondary_range_name = google_compute_subnetwork.subnetwork-1.secondary_ip_range[1].range_name
  }
  deletion_protection  = "true"
}
Open in Cloud Shell

Example Usage - Dns Managed Zone Private Peering

resource "google_dns_managed_zone" "peering-zone" {
  name        = "peering-zone"
  dns_name    = "peering.example.com."
  description = "Example private DNS peering zone"

  visibility = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.network-source.id
    }
  }

  peering_config {
    target_network {
      network_url = google_compute_network.network-target.id
    }
  }
}

resource "google_compute_network" "network-source" {
  name                    = "network-source"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-target" {
  name                    = "network-target"
  auto_create_subnetworks = false
}
Open in Cloud Shell

Example Usage - Dns Managed Zone Service Directory

resource "google_dns_managed_zone" "sd-zone" {
  provider = google-beta

  name        = "peering-zone"
  dns_name    = "services.example.com."
  description = "Example private DNS Service Directory zone"

  visibility = "private"

  service_directory_config {
    namespace {
      namespace_url = google_service_directory_namespace.example.id
    }
  }
}

resource "google_service_directory_namespace" "example" {
  provider = google-beta

  namespace_id = "example"
  location     = "us-central1"
}

resource "google_compute_network" "network" {
  provider = google-beta

  name                    = "network"
  auto_create_subnetworks = false
}
Open in Cloud Shell

Example Usage - Dns Managed Zone Cloud Logging

resource "google_dns_managed_zone" "cloud-logging-enabled-zone" {
  name        = "cloud-logging-enabled-zone"
  dns_name    = "services.example.com."
  description = "Example cloud logging enabled DNS zone"
  labels = {
    foo = "bar"
  }

  cloud_logging_config {
    enable_logging = true
  }
}

Argument Reference

The following arguments are supported:


The dnssec_config block supports:

The default_key_specs block supports:

The private_visibility_config block supports:

The gke_clusters block supports:

The networks block supports:

The forwarding_config block supports:

The target_name_servers block supports:

The peering_config block supports:

The target_network block supports:

The service_directory_config block supports:

The namespace block supports:

The cloud_logging_config block supports:

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

Timeouts

This resource provides the following Timeouts configuration options:

Import

ManagedZone can be imported using any of these accepted formats:

In Terraform v1.5.0 and later, use an import block to import ManagedZone using one of the formats above. For example:

import {
  id = "projects/{{project}}/managedZones/{{name}}"
  to = google_dns_managed_zone.default
}

When using the terraform import command, ManagedZone can be imported using one of the formats above. For example:

$ terraform import google_dns_managed_zone.default projects/{{project}}/managedZones/{{name}}
$ terraform import google_dns_managed_zone.default {{project}}/{{name}}
$ terraform import google_dns_managed_zone.default {{name}}

User Project Overrides

This resource supports User Project Overrides.