google_dns_record_set can silently overwrite existing record

[ruanda]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.10.1
on linux_amd64

• provider registry.terraform.io/hashicorp/google v6.13.0
• provider registry.terraform.io/hashicorp/google-beta v6.13.0

Affected Resource(s)

google_dns_record_set

Terraform Configuration

resource "google_dns_record_set" "a" {
  name         = "backend.${google_dns_managed_zone.prod.dns_name}"
  managed_zone = google_dns_managed_zone.prod.name
  type         = "A"
  ttl          = 300

  rrdatas = ["8.8.8.8"]
}

resource "google_dns_managed_zone" "prod" {
  name     = "prod-zone"
  dns_name = "prod.mydomain.com."
}

Debug Output

No response

Expected Behavior

If the record already exists the resource creation should fail.

Actual Behavior

If the record already exists the resource overwrite it.

Steps to reproduce

1. terraform apply

Important Factoids

This is documented behavior. This is similar to 10661. Unfortunately there is no way to detect this situation if DNS records are managed across many terraform workspaces. There should be either attribute which modifies authoritativeness of the resource or secondary resource type which is non-authoritative (just like there are iam_member and iam_binding types).

References

#10661

[c2thorn]

Changing this to a feature request as it is a request to add options to control the authoratative behavior in google_dns_record_set creation