### Initialize Example Module for Kitchen Testing

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Initializes the working directory for a specific example module within the Kitchen testing framework. Replace `<EXAMPLE_NAME>` with the actual name of the example module to be tested.

```bash
kitchen_do create <EXAMPLE_NAME>
```

--------------------------------

### Apply Example Module with Kitchen

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Applies the Terraform configuration for a specified example module using the Kitchen testing framework. This command provisions the resources defined in the example module. Replace `<EXAMPLE_NAME>` with the target example module.

```bash
kitchen_do converge <EXAMPLE_NAME>
```

--------------------------------

### Verify Example Module with Kitchen

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Runs the verification tests for a specified example module using the Kitchen testing framework. This step checks if the deployed resources behave as expected. Replace `<EXAMPLE_NAME>` with the relevant example module.

```bash
kitchen_do verify <EXAMPLE_NAME>
```

--------------------------------

### Destroy Example Module State with Kitchen

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Cleans up and destroys the resources provisioned for a specific example module by the Kitchen testing framework. This command reverts the changes made during the converge step. Replace `<EXAMPLE_NAME>` with the example module to be destroyed.

```bash
kitchen_do destroy <EXAMPLE_NAME>
```

--------------------------------

### Start Testing Docker Container Interactively

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Launches the Docker container used for testing in interactive mode, allowing for manual execution of Kitchen commands. This is useful for debugging or running specific test scenarios.

```bash
make docker_run
```

--------------------------------

### Run Noninteractive Integration Tests with Docker

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Executes all integration tests for the example modules noninteractively within a Docker container. This command verifies the functionality of the root module, submodules, and example modules using the prepared test project.

```bash
make docker_test_integration
```

--------------------------------

### Create Public DNS Zone with DNSSEC and Logging using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

This example shows how to provision a public DNS zone with DNSSEC enabled for enhanced security and query logging for monitoring. It configures key signing and zone signing keys, along with various DNS record types.

```hcl
module "dns-public-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "public"
  name       = "example-public-zone"
  domain     = "example.com."

  labels = {
    environment = "production"
  }

  # Enable query logging for monitoring and debugging
  enable_logging = true

  # Enable DNSSEC for the zone
  dnssec_config = {
    state         = "on"
    non_existence = "nsec3"
  }

  # Key signing key specifications
  default_key_specs_key = {
    algorithm  = "rsasha256"
    key_length = 2048
    key_type   = "keySigning"
  }

  # Zone signing key specifications
  default_key_specs_zone = {
    algorithm  = "rsasha256"
    key_length = 1024
    key_type   = "zoneSigning"
  }

  recordsets = [
    {
      name = "www"
      type = "A"
      ttl  = 300
      records = [
        "203.0.113.10",
        "203.0.113.11",
      ]
    },
    {
      name = ""
      type = "A"
      ttl  = 300
      records = [
        "203.0.113.10",
      ]
    },
    {
      name = ""
      type = "MX"
      ttl  = 3600
      records = [
        "10 mail1.example.com.",
        "20 mail2.example.com.",
      ]
    },
    {
      name = ""
      type = "TXT"
      ttl  = 3600
      records = [
        "\"v=spf1 include:_spf.google.com ~all\"",
      ]
    },
    {
      name = "_dmarc"
      type = "TXT"
      ttl  = 3600
      records = [
        "\"v=DMARC1; p=reject; rua=mailto:dmarc@example.com\"",
      ]
    },
  ]
}

# Outputs
# module.dns-public-zone.name         = "example-public-zone"
# module.dns-public-zone.domain       = "example.com."
# module.dns-public-zone.name_servers = ["ns-cloud-a1.googledomains.com.", ...]
```

--------------------------------

### Create Google Cloud DNS Forwarding Zone

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Creates a forwarding DNS zone to redirect queries for specific domains to external name servers. This is useful for hybrid cloud setups or integrating with on-premises DNS. It requires specifying the project, zone type, name, domain, and target name server addresses.

```hcl
module "dns-forwarding-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "forwarding"
  name       = "onprem-forwarding-zone"
  domain     = "corp.internal."

  labels = {
    purpose = "hybrid-dns"
  }

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  # Target name servers for forwarding (e.g., on-premises DNS servers)
  target_name_server_addresses = [
    {
      ipv4_address    = "10.100.0.53"
      forwarding_path = "private"  # Route through VPN/Interconnect
    },
    {
      ipv4_address    = "10.100.0.54"
      forwarding_path = "private"
    }
  ]
}

# Alternative: Forward to public DNS resolvers
module "dns-forwarding-public" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "forwarding"
  name       = "external-forward-zone"
  domain     = "partner.example.com."

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  target_name_server_addresses = [
    {
      ipv4_address    = "8.8.8.8"
      forwarding_path = "default"  # Route through public internet
    },
    {
      ipv4_address    = "8.8.4.4"
      forwarding_path = "default"
    }
  ]
}

# Outputs
# module.dns-forwarding-zone.name   = "onprem-forwarding-zone"
# module.dns-forwarding-zone.domain = "corp.internal."
```

--------------------------------

### Configure DNS Zone IAM Permissions using Terraform Policy

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Configures IAM permissions for a private DNS managed zone using the IAM policy approach, which replaces all existing bindings. This example uses the 'terraform-google-modules/cloud-dns/google' module to set the 'dns.admin' role for specified members.

```hcl
# Option 1: Using IAM Policy (replaces all existing bindings)
module "dns-zone-iam-policy" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "private"
  name       = "iam-policy-zone"
  domain     = "policy.internal."

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  iam_choice = "iam_policy"
  role       = "roles/dns.admin"
  members = [
    "serviceAccount:dns-admin@my-project-id.iam.gserviceaccount.com",
    "group:dns-admins@example.com"
  ]

  recordsets = []
}
```

--------------------------------

### Terraform HCL: New DNS Record Format (v3.0+)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/docs/upgrading_to_v3.0.md

This snippet illustrates the updated format for specifying DNS records in the Terraform Google Cloud DNS module starting from v3.0, utilizing a single 'recordsets' variable for consolidated record definition.

```hcl
recordsets = [
  {
    name    = "localhost"
    type    = "A"
    ttl     = 300
    records = [
      "127.0.0.1",
    ]
  },
]
```

--------------------------------

### Create DNS Response Policy with Rules (Terraform)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/modules/dns_response_policy/README.md

This snippet demonstrates the basic usage of the terraform-google-modules/cloud-dns/google//modules/dns_response_policy module to create a DNS response policy. It includes examples of overriding DNS records for specific domains and implementing a bypass rule. The module requires project ID, policy name, network self-links, and a map of rules as input.

```hcl
module "dns_response_policy" {
  source             = "terraform-google-modules/cloud-dns/google//modules/dns_response_policy"
  project_id         = "example-project-id"
  policy_name        = "example-policy-name"
  network_self_links = ["projects/example-project-id/global/networks/default"]
  description        = "Example DNS response policy created by terraform module."
  rules = {
    "override-google-com" = {
      dns_name = "*.google.com."
      rule_local_datas = {
        "A" = { # Record type.
          rrdatas = ["192.0.2.91"]
          ttl     = 300
        },
        "AAAA" = {
          rrdatas = ["2001:db8::8bd:1002"]
          ttl     = 300
        }
      }
    },
    "override-withgoogle-com" = {
      dns_name = "withgoogle.com."
      rule_local_datas = {
        "A" = {
          rrdatas = ["193.0.2.93"]
          ttl     = 300
        }
      }
    },
    "bypass-google-account-domain" = {
      dns_name      = "account.google.com."
      rule_behavior = "bypassResponsePolicy"
    }
  }
}
```

--------------------------------

### Configure GKE Cluster DNS Visibility using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

This snippet configures a private DNS zone for GKE clusters, enabling pod-to-service DNS resolution. It uses the 'terraform-google-modules/cloud-dns/google' module, specifying project, type, name, domain, and GKE cluster lists. It also includes example record sets for services.

```hcl
module "dns-gke-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "private"
  name       = "gke-services-zone"
  domain     = "svc.cluster.local."

  labels = {
    purpose = "gke-dns"
  }

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  gke_clusters_list = [
    "projects/my-project-id/locations/us-central1/clusters/prod-cluster",
    "projects/my-project-id/locations/us-central1/clusters/staging-cluster"
  ]

  recordsets = [
    {
      name = "backend"
      type = "A"
      ttl  = 300
      records = [
        "10.0.10.100",
      ]
    },
    {
      name = "frontend"
      type = "A"
      ttl  = 300
      records = [
        "10.0.10.101",
      ]
    },
  ]
}
```

--------------------------------

### Prepare Test Project using Docker

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Prepares the necessary infrastructure and environment for running integration tests within a Docker container. This command assumes the service account credentials and test environment variables have been set.

```bash
make docker_test_prepare
```

--------------------------------

### Generate Documentation Tables with Make

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Automatically generates Inputs and Outputs tables for module READMEs. This command should be run whenever module interfaces (variables or outputs) are modified. It relies on the 'make' utility.

```bash
make generate_docs
```

--------------------------------

### Terraform Configuration for Forwarding DNS Zone

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This configuration demonstrates setting up a forwarding DNS zone. It requires specifying the zone's domain, project ID, and a list of target name server IP addresses to which queries for this zone will be forwarded.

```terraform
module "forwarding_dns_zone" {
  source = "terraform-google-modules/dns/google"
  version = "~> 4.0"

  name       = "my-forwarding-zone"
  domain     = "forward.example.com."
  project_id = "your-gcp-project-id"
  type       = "forwarding"

  target_name_server_addresses = [
    { ip_address = "8.8.8.8" },
    { ip_address = "8.8.4.4" }
  ]
}
```

--------------------------------

### Run Linting and Formatting Checks with Docker

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Executes linting and formatting checks on the repository files using a Docker container. This command helps maintain code quality and consistency across the project.

```bash
make docker_test_lint
```

--------------------------------

### Create Google Cloud DNS Reverse Lookup Zone

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Configures a reverse DNS lookup zone for PTR records, enabling IP-to-hostname resolution within VPC networks. This requires the google-beta provider and specifies the project, zone type, name, domain, and individual PTR record sets.

```hcl
module "dns-reverse-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "reverse_lookup"
  name       = "reverse-10-0-0"
  domain     = "0.0.10.in-addr.arpa."  # Reverse zone for 10.0.0.0/24

  labels = {
    network = "internal"
  }

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  recordsets = [
    {
      name = "1"  # 10.0.0.1
      type = "PTR"
      ttl  = 300
      records = [
        "gateway.internal.example.com.",
      ]
    },
    {
      name = "10"  # 10.0.0.10
      type = "PTR"
      ttl  = 300
      records = [
        "webserver.internal.example.com.",
      ]
    },
    {
      name = "20"  # 10.0.0.20
      type = "PTR"
      ttl  = 300
      records = [
        "database.internal.example.com.",
      ]
    },
  ]
}

# Outputs
# module.dns-reverse-zone.name   = "reverse-10-0-0"
# module.dns-reverse-zone.domain = "0.0.10.in-addr.arpa."
```

--------------------------------

### Create Google Cloud DNS Service Directory Zone

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Creates a DNS zone integrated with Service Directory for automatic DNS resolution of registered services. This feature requires the google-beta provider and involves specifying the project, zone type, name, domain, and the Service Directory namespace URL.

```hcl
module "dns-service-directory-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "service_directory"
  name       = "service-discovery-zone"
  domain     = "sd.internal."

  labels = {
    purpose = "service-discovery"
  }

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  # Service Directory namespace URL
  service_namespace_url = "projects/my-project-id/locations/us-central1/namespaces/my-namespace"
}
```

--------------------------------

### Export Service Account Credentials for Testing

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Sets the Google Cloud service account credentials as an environment variable for use in testing. This requires a 'credentials.json' file containing the service account key. The variable `SERVICE_ACCOUNT_JSON` is used by subsequent testing commands.

```bash
export SERVICE_ACCOUNT_JSON=$(< credentials.json)
```

--------------------------------

### Set Test Environment Variables for Google Cloud

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/CONTRIBUTING.md

Configures essential environment variables required for setting up and running integration tests within a Google Cloud project. These variables specify the organization ID, folder ID, and billing account ID.

```bash
export TF_VAR_org_id="your_org_id"
export TF_VAR_folder_id="your_folder_id"
export TF_VAR_billing_account="your_billing_account_id"
```

--------------------------------

### Create Google Cloud DNS Peering Zone

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Establishes a DNS peering zone to forward queries to another VPC network's DNS resolver, facilitating cross-project or cross-VPC DNS resolution. It requires specifying the consumer project, zone type, name, domain, target network, and optionally IAM roles for access.

```hcl
module "dns-peering-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "consumer-project-id"
  type       = "peering"
  name       = "shared-services-peering"
  domain     = "shared.internal."

  labels = {
    peering_target = "shared-services"
  }

  # VPC network that will use this peering zone
  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/consumer-project-id/global/networks/consumer-vpc"
  ]

  # Target VPC network that contains the authoritative DNS zone
  target_network = "https://www.googleapis.com/compute/v1/projects/shared-services-project/global/networks/shared-vpc"

  # Optional: Grant viewer access to a service account
  iam_choice = "iam_member"
  role       = "roles/dns.reader"
  member     = "serviceAccount:dns-reader@consumer-project-id.iam.gserviceaccount.com"
}

# Outputs
# module.dns-peering-zone.name   = "shared-services-peering"
# module.dns-peering-zone.domain = "shared.internal."
# module.dns-peering-zone.type   = "peering"
```

--------------------------------

### Configure Private DNS Zone with IAM Binding using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

This snippet demonstrates how to create a private DNS zone and configure IAM permissions using an 'iam_binding'. It requires the 'terraform-google-modules/cloud-dns/google' module and specifies project, type, name, domain, and network visibility. The IAM binding grants 'roles/dns.reader' to specified service accounts.

```hcl
module "dns-zone-iam-binding" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "private"
  name       = "iam-binding-zone"
  domain     = "binding.internal."

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  iam_choice = "iam_binding"
  role       = "roles/dns.reader"
  members = [
    "serviceAccount:app1@my-project-id.iam.gserviceaccount.com",
    "serviceAccount:app2@my-project-id.iam.gserviceaccount.com"
  ]

  recordsets = []
}
```

--------------------------------

### Configure DNS Records with Routing Policies using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Creates DNS records with advanced routing policies, including weighted round-robin for traffic distribution and geolocation-based routing for latency optimization. This configuration requires the 'terraform-google-modules/cloud-dns/google' module and defines record sets with various routing strategies.

```hcl
module "dns-with-routing-policies" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "public"
  name       = "routing-example-zone"
  domain     = "routing.example.com."

  recordsets = [
    # Standard A record
    {
      name = "api"
      type = "A"
      ttl  = 300
      records = [
        "203.0.113.10",
      ]
    },
    # Weighted Round Robin routing - distribute traffic 80/20
    {
      name = "app"
      type = "A"
      ttl  = 300
      records = null  # Must be null when using routing_policy
      routing_policy = {
        wrr = [
          {
            weight  = 80
            records = ["203.0.113.100"]  # Primary server
          },
          {
            weight  = 20
            records = ["203.0.113.101"]  # Canary/secondary server
          }
        ]
        geo = []
      }
    },
    # Geolocation-based routing
    {
      name = "cdn"
      type = "A"
      ttl  = 300
      records = null
      routing_policy = {
        wrr = []
        geo = [
          {
            location = "us-east1"
            records  = ["203.0.113.50"]  # US East server
          },
          {
            location = "europe-west1"
            records  = ["203.0.113.60"]  # Europe server
          },
          {
            location = "asia-east1"
            records  = ["203.0.113.70"]  # Asia server
          }
        ]
      }
    },
  ]
}

# Outputs
# module.dns-with-routing-policies.name   = "routing-example-zone"
# module.dns-with-routing-policies.domain = "routing.example.com."
```

--------------------------------

### Create Private DNS Zone with Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

This snippet demonstrates how to create a private DNS zone using the Terraform Google Cloud DNS module. It configures the zone for internal use within specified VPC networks and includes multiple record sets for services and domain configuration. Optional IAM policies can also be applied.

```hcl
module "dns-private-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "private"
  name       = "internal-example-zone"
  domain     = "internal.example.com."

  labels = {
    environment = "production"
    team        = "platform"
  }

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  recordsets = [
    {
      name = "ns"
      type = "A"
      ttl  = 300
      records = [
        "10.0.0.1",
      ]
    },
    {
      name = ""
      type = "NS"
      ttl  = 300
      records = [
        "ns.internal.example.com.",
      ]
    },
    {
      name = "api"
      type = "A"
      ttl  = 300
      records = [
        "10.0.1.100",
      ]
    },
    {
      name = ""
      type = "MX"
      ttl  = 300
      records = [
        "10 mail.internal.example.com.",
      ]
    },
    {
      name = ""
      type = "TXT"
      ttl  = 300
      records = [
        "\"v=spf1 -all\"",
      ]
    },
  ]

  # Optional: Configure IAM policy for the zone
  iam_choice = "iam_policy"
  role       = "roles/dns.reader"
  members    = ["serviceAccount:app-service@my-project-id.iam.gserviceaccount.com"]
}

# Outputs
# module.dns-private-zone.name       = "internal-example-zone"
# module.dns-private-zone.domain     = "internal.example.com."
# module.dns-private-zone.type       = "private"
# module.dns-private-zone.name_servers = ["ns-cloud-a1.googledomains.com.", ...]
```

--------------------------------

### Terraform Configuration for DNS Record Sets

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This Terraform configuration illustrates how to define DNS record sets within a managed zone. It supports various record types (A, CNAME, MX, TXT, etc.) and advanced features like weighted round-robin (WRR) and geo-location routing policies.

```terraform
module "dns_zone_with_records" {
  source = "terraform-google-modules/dns/google"
  version = "~> 4.0"

  name       = "my-zone-with-records"
  domain     = "records.example.com."
  project_id = "your-gcp-project-id"

  recordsets = [
    {
      name = "www.records.example.com."
      type = "A"
      ttl  = 300
      records = ["192.0.2.1", "192.0.2.2"]
    },
    {
      name = "mail.records.example.com."
      type = "CNAME"
      ttl  = 3600
      records = ["mail.google.com."]
    },
    {
      name = "geo.records.example.com."
      type = "A"
      ttl  = 300
      routing_policy = {
        geo = [
          {
            location = "us-east"
            records  = ["192.0.2.10"]
          },
          {
            location = "us-west"
            records  = ["192.0.2.20"]
          }
        ]
      }
    }
  ]
}
```

--------------------------------

### Terraform Configuration for Google Cloud DNS Managed Zone

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This snippet demonstrates a basic Terraform configuration for creating a Google Cloud DNS Managed Zone. It requires specifying the zone's domain and project ID. Optional parameters like description, labels, and DNSSEC configuration can be included.

```terraform
module "dns_zone" {
  source = "terraform-google-modules/dns/google"
  version = "~> 4.0"

  name       = "my-managed-zone"
  domain     = "example.com."
  project_id = "your-gcp-project-id"
  description = "Managed by Terraform"

  labels = {
    environment = "production"
  }

  dnssec_config = {
    kind   = "ON ולה"
    state  = "ON"
  }
}
```

--------------------------------

### Create DNS Response Policy using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

Creates a DNS response policy to override or bypass DNS resolution for specific domains within a VPC network. This is useful for blocking malicious domains or redirecting traffic. It utilizes the 'dns_response_policy' module within the 'terraform-google-modules/cloud-dns/google' provider.

```hcl
module "dns_response_policy" {
  source  = "terraform-google-modules/cloud-dns/google//modules/dns_response_policy"
  version = "~> 6.0"

  project_id         = "my-project-id"
  policy_name        = "security-response-policy"
  description        = "DNS response policy for security and internal routing"

  network_self_links = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  rules = {
    # Override: Redirect internal API calls to internal load balancer
    "internal-api-redirect" = {
      dns_name = "api.external-service.com."
      rule_local_datas = {
        "A" = {
          rrdatas = ["10.0.1.100"]  # Internal load balancer IP
          ttl     = 300
        }
      }
    },

    # Override: Block malicious domain with wildcard
    "block-malicious-domain" = {
      dns_name = "*.malicious-site.com."
      rule_local_datas = {
        "A" = {
          rrdatas = ["0.0.0.0"]  # Sinkhole
          ttl     = 3600
        },
        "AAAA" = {
          rrdatas = ["::"]
          ttl     = 3600
        }
      }
    },

    # Override: Custom internal service discovery
    "internal-db-cluster" = {
      dns_name = "database.internal."
      rule_local_datas = {
        "A" = {
          rrdatas = ["10.0.2.10", "10.0.2.11", "10.0.2.12"]
          ttl     = 60
        }
      }
    },

    # Bypass: Allow specific subdomain to resolve normally
    "bypass-allowed-service" = {
      dns_name      = "allowed.external-service.com."
      rule_behavior = "bypassResponsePolicy"
    }
  }
}

# Outputs
# module.dns_response_policy.response_policy_id = "projects/my-project-id/responsePolicies/security-response-policy"
# module.dns_response_policy.response_policy_rule_ids = [
#   "projects/my-project-id/responsePolicies/security-response-policy/rules/internal-api-redirect",
#   "projects/my-project-id/responsePolicies/security-response-policy/rules/block-malicious-domain",
#   ...
# ]
```

--------------------------------

### Create Private DNS Zone with Records - Terraform

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This Terraform configuration demonstrates how to create a private DNS zone in Google Cloud. It specifies the project, zone type, name, domain, network visibility, and defines multiple record sets with their respective names, types, TTLs, and records. This is useful for internal DNS resolution within a specified VPC network.

```hcl
module "dns-private-zone" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "4.0"
  project_id = "my-project"
  type       = "private"
  name       = "example-com"
  domain     = "example.com."

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project/global/networks/my-vpc"
  ]

  recordsets = [
    {
      name    = ""
      type    = "NS"
      ttl     = 300
      records = [
        "127.0.0.1",
      ]
    },
    {
      name    = "localhost"
      type    = "A"
      ttl     = 300
      records = [
        "127.0.0.1",
      ]
    },
  ]
}

```

--------------------------------

### Terraform Configuration for IAM Policy Binding

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This snippet illustrates how to manage IAM policies for a DNS managed zone using Terraform. It shows how to bind a specific role to a member or members for the managed zone.

```terraform
module "dns_zone_iam" {
  source = "terraform-google-modules/dns/google"
  version = "~> 4.0"

  name       = "my-iam-zone"
  domain     = "iam.example.com."
  project_id = "your-gcp-project-id"

  # Example using iam_member
  iam_choice = "iam_member"
  member     = "user:test-user@example.com"
  role       = "roles/dns.reader"

  # Example using iam_binding (uncomment to use)
  # iam_choice = "iam_binding"
  # members    = [
  #   "user:test-user@example.com",
  #   "serviceAccount:my-sa@your-gcp-project-id.iam.gserviceaccount.com"
  # ]
  # role       = "roles/dns.viewer"
}
```

--------------------------------

### Terraform Configuration for Private DNS Zone

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/README.md

This snippet shows how to create a private managed DNS zone in Google Cloud. It requires specifying the zone's domain, project ID, and a list of VPC networks that will have access to this private zone.

```terraform
module "private_dns_zone" {
  source = "terraform-google-modules/dns/google"
  version = "~> 4.0"

  name       = "my-private-zone"
  domain     = "internal.example.com."
  project_id = "your-gcp-project-id"
  type       = "private"

  private_visibility_config_networks = [
    "projects/your-gcp-project-id/global/networks/your-vpc-network-name"
  ]
}
```

--------------------------------

### Configure Private DNS Zone with IAM Member using Terraform

Source: https://context7.com/terraform-google-modules/terraform-google-cloud-dns/llms.txt

This snippet shows how to create a private DNS zone and add a single IAM member using the 'iam_member' option. It utilizes the 'terraform-google-modules/cloud-dns/google' module, defining project, type, name, domain, and network visibility. The IAM member is granted a specific role.

```hcl
module "dns-zone-iam-member" {
  source  = "terraform-google-modules/cloud-dns/google"
  version = "~> 6.0"

  project_id = "my-project-id"
  type       = "private"
  name       = "iam-member-zone"
  domain     = "member.internal."

  private_visibility_config_networks = [
    "https://www.googleapis.com/compute/v1/projects/my-project-id/global/networks/my-vpc"
  ]

  iam_choice = "iam_member"
  role       = "roles/dns.reader"
  member     = "serviceAccount:single-app@my-project-id.iam.gserviceaccount.com"

  recordsets = []
}
```

--------------------------------

### Terraform HCL: Old DNS Record Format (Pre-v3.0)

Source: https://github.com/terraform-google-modules/terraform-google-cloud-dns/blob/main/docs/upgrading_to_v3.0.md

This snippet demonstrates the previous format for specifying DNS records in the Terraform Google Cloud DNS module, using separate lists for record names and record data.

```hcl
record_names = ["localhost"]
record_data = [
  {
    rrdatas = "127.0.0.1"
    type    = "A"
  }
]
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.