Oracle CloudPlan-validated

DNS Zone & Traffic Steering

Name: DNS Zone & Traffic Steering
Brand: IaC Bazaar
SKU: oci-dns-zone
Availability: InStock

Public/private DNS zones with record sets, failover/geo steering policies and health-check probes.

terraformOracle Cloudoci

Compare DNS & Traffic Management across clouds →

Part of: OCI Production Landing Zone

oci-dns-zonevizier v1.2.0

Verification

Plan-validated

Passed: module logic verified on a mocked plan - inputs, validation rules, conditional creation and outputs resolve (no real provider, no cloud).

Conformance

Static validation (fmt · validate · tflint)
Security scan clean (Checkov)
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o oci-dns-zone-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/oci-dns-zone/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle oci-dns-zone-1.0.0.sigstore.json \
  oci-dns-zone-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "29d1eb744d4e1922833e7873bd30d9311f05b3141082c59715532741558466dc  oci-dns-zone-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "dns_zone" {
  source  = "www.iac-bazaar.com/iac-bazaar/oci-dns-zone/oci"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads plan-validated because the record says so, and the link lands on this page.

README.md, GitLab, Gitea

[![IaC Bazaar: plan-validated](https://www.iac-bazaar.com/api/artifacts/oci-dns-zone/badge)](https://www.iac-bazaar.com/catalog/oci-dns-zone?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, plan-validated on IaC Bazaar: [DNS Zone & Traffic Steering](https://www.iac-bazaar.com/catalog/oci-dns-zone?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "dns_zone" {
  source  = "www.iac-bazaar.com/iac-bazaar/oci-dns-zone/oci"
  version = "1.0.0"
}
```

Preview:

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

oci-dns-zone

Status: static-validated, live-test pending. This module ships under live-test quarantine — it passes tofu fmt, tofu validate and tflint, but a real apply → verify → destroy has not yet run (no OCI cloud sandbox available). Promotion to a full live-tested artifact follows when a sandbox exists.

OCI DNS made plug-and-play: a PRIMARY zone (public global or private view-scoped) with its record sets, plus optional traffic-management steering policies (failover / geo / load-balance) backed by HTTP health-check monitors. Works with Terraform and OpenTofu (>= 1.6), OCI provider >= 8.0, < 9.0.

Secure defaults:

PRIMARY zones only — OCI is the source of truth; no SECONDARY zone pulling from a harder-to-trust external master.
DNSSEC enabled by default on public (GLOBAL) zones for origin authentication. Private zones force it off (unsupported there).
Private zones are view-scoped — resolvable only inside the VCNs bound to the view, never exposed to the internet. A view_id is required and validated for scope = PRIVATE.
Steering policy ordering is handled for you: the attachment references the fully-formed policy resource (with its answers), so the documented "attach-before-answers" race is avoided.

Requirements

Terraform or OpenTofu >= 1.6
Provider oracle/oci >= 8.0, < 9.0

License

Commercial — LicenseRef-IaCBazaar-Commercial.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

Usage
Inputs
Outputs
Notes

Create a free account Sign in

Related modules

Static validatedLive test pending

civo-dns-zone

A Civo DNS zone with every record in one map, each with the TTL Civo requires per record, and the nameservers exported for the registrar. Civo does not sign zones and has no CAA or NS record types; dnssec_available says so, so a domain that needs DNSSEC is sent elsewhere before it is delegated.

View module

Static validatedLive test pending

do-dns-zone

A DigitalOcean domain and its records. Creating the zone does not delegate it: until the registrar's nameservers point here the zone is correct, complete and serving nobody, which looks exactly like a working zone. The domain's ip_address shortcut, which hides an apex A record from your records map, is deliberately not used, and a CNAME at the apex is refused.

View module

Static validatedLive test pending

tencent-dns-zone

A Tencent Cloud DNSPod zone with every record in one map, all on the default resolution line so every resolver gets the same answer, MX priority carried on the record, and the free-grade nameservers exported for the registrar. DNSSEC is not a resource in the provider; dnssec_available says so.

View module

Static validatedLive test pending

huawei-dns-zone

A Huawei Cloud public DNS zone with the flat record map grouped into the record sets Huawei expects (one per name and type, several values), DNSSEC on with the DS record for the registrar, and the nameservers exported. Private zones bound to a VPC are a different zone type and not this module.

View module

Static validatedLive test pending

azure-dns-private-resolver

A resolver is five resources - endpoints, ruleset, rules and VNet links - and the half-built state most sit in resolves Azure names and forwards nothing to on-premises; a ruleset not linked to a VNet applies to nothing; and each endpoint needs its own delegated subnet. All five created, forwarding rules required, VNet links expected (none by name), the inbound address exported.

View module

Static validatedLive test pending

ibm-dns-zone

An IBM Cloud DNS Services private zone, its permitted networks and its records. The zone and the permission are separate resources: with none, the zone is created, the records are created, everything reports Active, and no VPC can resolve any of it. An empty list is refused. This is private DNS and it is not the public zone, which is CIS.

View module