IaC Bazaar
Google CloudLive-tested

Cloud DNS Zones & Records

Public/private managed zones with record sets, DNSSEC, forwarding and peering configs.

terraformGoogle Cloud#gcp

Compare DNS & Traffic Management across clouds →

Part of: GCP Production Landing Zone

gcp-cloud-dnsterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan pending (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-30 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o gcp-cloud-dns-1.0.1.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/gcp-cloud-dns/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle gcp-cloud-dns-1.0.1.sigstore.json \
  gcp-cloud-dns-1.0.1.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "b214736ada7bee9219a329171195654d40837232447b255e82dca3a2b02b1bb4  gcp-cloud-dns-1.0.1.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "cloud_dns" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-cloud-dns/gcp"
  version = "1.0.1"
}

Free module — Terraform/OpenTofu downloads it with no token or setup. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

This module is in the Free band, and a free account sees the contract of every Free module — no subscription needed.

Create a free account →Sign in

Documentation

gcp-cloud-dns

A Cloud DNS managed zone with record sets — private by default (resolvable only from the VPC networks you bind), with optional DNS forwarding and peering for hybrid resolution, and DNSSEC signing plus query logging turned on for public zones. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Status: static-validated, live-test pending. Ships under live-test quarantine — validated with tofu fmt, tofu validate, and tflint. Real apply → verify → destroy against a GCP project is pending a cloud sandbox.

Secure defaults

  • Private visibility by default — a zone is only resolvable from VPC networks (or GKE clusters) you explicitly bind. A plan-time precondition rejects a private zone with no network binding and no forwarding/peering, so you never ship a zone that resolves nowhere.
  • DNSSEC on for public zones — signing enabled with NSEC3 authenticated denial of existence (the privacy-preserving mode that does not enumerate the zone).
  • Query logging on for public zones — an audit trail of resolution.
  • force_destroy = false — destroy will not silently wipe a zone that still has records; you must opt in.
  • Forwarding vs peering are mutually exclusive, and forwarding/peering zones cannot also host record sets — both enforced as preconditions.

DNSSEC and query logging apply to public zones only and are ignored on private zones (which GCP cannot sign).

Requirements

  • Terraform or OpenTofu >= 1.6
  • hashicorp/google >= 7.0, < 8.0

License

Commercial — LicenseRef-IaCBazaar-Commercial.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs

Related modules

Akamai✓ live-tested

Akamai Edge DNS Zone

Authoritative Edge DNS zone with full recordset management on Akamai's DDoS-resilient anycast network.

$0.00v1.0.2
AkamaiEdge & DNS

Akamai GTM Failover/Weighted Domain

Global Traffic Management domain with datacenters and failover or weighted-round-robin properties plus liveness tests.

$59.00v1.0.0
Azure✓ live-tested

Azure Private DNS Zone

A self-contained Azure Private DNS zone with virtual-network links and optional record sets for private name resolution across VNets and Private Endpoints - VM auto-registration off by default.

$29.00v1.0.0
Azure✓ live-tested

Azure Public DNS Zone & Records

An Azure public DNS zone plus a map-driven set of record sets - A, AAAA, CNAME, TXT, MX, NS, CAA and SRV - with relative naming, verbatim TXT values, and apex footgun guards.

$0.00v1.0.1
CloudflareEdge & DNS

Cloudflare DNS & WAF

Zone DNS records, security settings, and managed WAF rulesets for a Cloudflare zone - provider v5 ready.

$59.00v1.0.0
Oracle CloudOracle Cloud

DNS Zone & Traffic Steering

Public/private DNS zones with record sets, failover/geo steering policies and health-check probes.

$0.00v1.0.0