» google_dns_managed_zone

A zone is a subtree of the DNS namespace under one administrative responsibility. A ManagedZone is a resource that represents a DNS zone hosted by the Cloud DNS service.

To get more information about ManagedZone, see:

» Example Usage - Dns Managed Zone Basic

resource "google_dns_managed_zone" "example-zone" {
  name = "example-zone"
  dns_name = "example-${random_id.rnd.hex}.com."
  description = "Example DNS zone"
  labels = {
    foo = "bar"
  }
}

resource "random_id" "rnd" {
  byte_length = 4
}

» Example Usage - Dns Managed Zone Private

resource "google_dns_managed_zone" "private-zone" {
  name = "private-zone"
  dns_name = "private.example.com."
  description = "Example private DNS zone"
  labels = {
    foo = "bar"
  }

  visibility = "private"

  private_visibility_config {
    networks {
      network_url =  "${google_compute_network.network-1.self_link}"
    }
    networks {
      network_url =  "${google_compute_network.network-2.self_link}"
    }
  }
}

resource "google_compute_network" "network-1" {
  name = "network-1"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-2" {
  name = "network-2"
  auto_create_subnetworks = false
}

» Example Usage - Dns Managed Zone Private Forwarding

resource "google_dns_managed_zone" "private-zone" {
  provider = "google-beta"
  name = "private-zone"
  dns_name = "private.example.com."
  description = "Example private DNS zone"
  labels = {
    foo = "bar"
  }

  visibility = "private"

  private_visibility_config {
    networks {
      network_url =  "${google_compute_network.network-1.self_link}"
    }
    networks {
      network_url =  "${google_compute_network.network-2.self_link}"
    }
  }

  forwarding_config {
    target_name_servers {
      ipv4_address = "172.16.1.10"
    }
    target_name_servers {
      ipv4_address = "172.16.1.20"
    }
  }

}

resource "google_compute_network" "network-1" {
  name = "network-1"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-2" {
  name = "network-2"
  auto_create_subnetworks = false
}

» Example Usage - Dns Managed Zone Private Peering

resource "google_dns_managed_zone" "peering-zone" {
  provider = "google-beta"

  name = "peering-zone"
  dns_name = "peering.example.com."
  description = "Example private DNS peering zone"

  visibility = "private"

  private_visibility_config {
    networks {
      network_url =  "${google_compute_network.network-source.self_link}"
    }
  }

  peering_config {
    target_network {
      network_url = "${google_compute_network.network-target.self_link}"
    }
  }
}

resource "google_compute_network" "network-source" {
  provider = "google-beta"

  name = "network-source"
  auto_create_subnetworks = false
}

resource "google_compute_network" "network-target" {
  provider = "google-beta"

  name = "network-target"
  auto_create_subnetworks = false
}

provider "google-beta" {
  region = "us-central1"
  zone   = "us-central1-a"
}

» Argument Reference

The following arguments are supported:

  • dns_name - (Required) The DNS name of this managed zone, for instance "example.com.".

  • name - (Required) User assigned name for this resource. Must be unique within the project.


  • description - (Optional) A textual description field. Defaults to 'Managed by Terraform'.

  • labels - (Optional) A set of key/value label pairs to assign to this ManagedZone.

  • visibility - (Optional) The zone's visibility: public zones are exposed to the Internet, while private zones are visible only to Virtual Private Cloud resources. Must be one of: public, private.

  • private_visibility_config - (Optional) For privately visible zones, the set of Virtual Private Cloud resources that the zone is visible from. Structure is documented below.

  • forwarding_config - (Optional, Beta) The presence for this field indicates that outbound forwarding is enabled for this zone. The value of this field contains the set of destinations to forward to. Structure is documented below.

  • peering_config - (Optional, Beta) The presence of this field indicates that DNS Peering is enabled for this zone. The value of this field contains the network to peer with. Structure is documented below.

  • project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

The private_visibility_config block supports:

  • networks - (Optional) The list of VPC networks that can see this zone. Until the provider updates to use the Terraform 0.12 SDK in a future release, you may experience issues with this resource while updating. If you've defined a networks block and add another networks block while keeping the old block, Terraform will see an incorrect diff and apply an incorrect update to the resource. If you encounter this issue, remove all networks blocks in an update and then apply another update adding all of them back simultaneously. Structure is documented below.

The networks block supports:

  • network_url - (Optional) The fully qualified URL of the VPC network to bind to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}

The forwarding_config block supports:

  • target_name_servers - (Optional) List of target name servers to forward to. Cloud DNS will select the best available name server if more than one target is given. Structure is documented below.

The target_name_servers block supports:

  • ipv4_address - (Optional) IPv4 address of a target name server.

The peering_config block supports:

  • target_network - (Optional) The network with which to peer. Structure is documented below.

The target_network block supports:

  • network_url - (Optional) The fully qualified URL of the VPC network to forward queries to. This should be formatted like https://www.googleapis.com/compute/v1/projects/{project}/global/networks/{network}

» Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • name_servers - Delegate your managed_zone to these virtual name servers; defined by the server

» Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 4 minutes.
  • update - Default is 4 minutes.
  • delete - Default is 4 minutes.

» Import

ManagedZone can be imported using any of these accepted formats:

$ terraform import google_dns_managed_zone.default projects/{{project}}/managedZones/{{name}}
$ terraform import google_dns_managed_zone.default {{project}}/{{name}}
$ terraform import google_dns_managed_zone.default {{name}}