add a data source with list of DNS records

[pznamensky]

Current Terraform and Cloudflare provider version

$ terraform -v
Terraform v1.2.6
+ provider registry.terraform.io/cloudflare/cloudflare v3.25.0
...

Description

It would be very useful to have a data source with DNS records to be able to iterate over them in terraform. Corresponding API call: https://api.cloudflare.com/#dns-records-for-a-zone-list-dns-records

Use cases

We use terraform to manage most of our DNS records in Cloudflare. For some of them, we'd like to be sure we have enabled Zero Trust and for some of add an external monitoring (e.g. using this provider) At the moment we have to manually add DNS records to multiple places. But it would be much easier to iterate over DNS records and add monitoring/ZeroTrust/...

Potential Terraform configuration

data "cloudflare_records" "example" {
  zone_id  = var.zone_id
  filter {
    type    = "A"
    proxied = "true"
  }
}

References

No response

[jacobbednarz]

the example above is already achievable with https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/record for a single record. do you need one where multiple records are returned together? how would the multiple records resource be used differently to the existing single data source?

[pznamensky]

Indeed, the data source cloudflare_record already can return a record, but it's not very convenient in case you'd like to add an external monitoring for example for each domain with "A" record or enforce Zero Trust for all of these domains. I mean, I'd like to iterate over the list of records from the data source instead of querying each record or using terraform variables with predefined list of records.

[jacobbednarz]

it's possible but I'm unsure if you'd really want to monitor every A/AAAA record (for example) that a zone has. my guess is that you'll get to the point where you would have records excluded or iterate over later to remove before referencing in your monitoring. explicit is better than implicit comes to mind here.

I'm happy to accept the request however, it's definitely not at the top of the priority list for now given the niche usage. you're welcome to submit a PR if you'd like to see it sooner.

[bikerpatch]

With the recent release of terraform checks, the use case of this type of data source is to have Terraform check whether records have been created outside of Terraform, indicating potentially undesired (or potentially malicious) unmanaged configuration

[juneeighteen]

+1 for this issue. In my case there are multiple root TXT records at the root of the domain, and I need to obtain one of them. There is currently no way to filter (or even obtain all of them and filter inside Terraform) It just fails

Example:

• Create two TXT records at the root of the domain
• Query with this example:

  data "cloudflare_record" "spf" {
  zone_id = data.cloudflare_zone.main.id
  hostname = var.domain_name
  type = "TXT"
  }

[falkenbt]

I have the same problem with a slightly different use case: I want to import existing,l manually created NS records to manage them via terraform (several hundred of those). (You typically always have more than one NS record per domain - link.)

So I wanted to look up the cloudflare record id to import the records within an existing terraform module (which sets up dns in other systems at the moment). This fails with the same error. Using cf-terraforming doesn't help because it does not return the names or values of the NS records but only the ids, so I cannot map them to my domains in my terraform code. I can think of a workaround of importing them all into a temporary tfstate and then use that statefile to import them to the correct destination where I want to have them, but that's very cumbersome.

So it would really help to...

• return all matching records, not only single records
• add a "value" parameter to the data resource so I filter on the exact record when trying to look up the id of a record

[jacobbednarz]

This issue has been closed as we are now tracking this internally with service teams directly. If you would like an update or to be notified when/if the product ships with this change, please reach out to Cloudflare Support or your account team who can watch the internal feature request for you.

[bikerpatch]

😞