🟦 Infoblox NIOS DNS Records Terraform Module

Aggregates all nine NIOS DNS record types — A, AAAA, PTR, CNAME, MX, TXT, SRV, NS, and Alias — behind one module, each an independently-optional for_each collection keyed by a stable caller string. Built for infoblox v2.x / WAPI v2.12.3.

• 🟦 Manages nine NIOS DNS record resources — infoblox_a_record, infoblox_aaaa_record, infoblox_ptr_record, infoblox_cname_record, infoblox_mx_record, infoblox_txt_record, infoblox_srv_record, infoblox_ns_record, infoblox_alias_record.
• 🧩 Aggregation module — there is no this keystone. Every record type is a named for_each collection (a_records, aaaa_records, …) over its own map(object(...)), keyed by a caller-supplied stable string.
• 🎚️ Each collection is independently optional (defaults to {}). Populate only the record types you need; the rest create nothing.
• 🌐 Module-level shared defaults — one dns_view and one default_ttl apply to every record, with per-record overrides inside each object.
• 🏷️ Exposes the universal NIOS fields comment and ext_attrs (plain map(string), jsonencoded internally) on every record type except ns_records, whose WAPI object has none.
• 🔗 Emits one { key => WAPI ref } map per record type (the aggregation analogue of a single id), plus a merged record_fqdns map for monitoring and DTC wiring.

💡 Why it matters: DNS records share an identical shape (fqdn, dns_view, comment, ext_attrs, ttl) and are almost always provisioned together against the same zone. One aggregation module with nine optional collections is the right boundary — far cleaner than nine separate module calls.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart TD
 NV["terraform-infoblox-network-view<br/>(network_view)"]
 DV["terraform-infoblox-dns-view<br/>(dns_view)"]
 ZA["terraform-infoblox-zone-auth<br/>(authoritative zone)"]
 DREC["terraform-infoblox-dns-records<br/>(9 record types)"]
 DTC["terraform-infoblox-dtc<br/>(LBDN / pool / server)"]
 IPAM["IPAM modules<br/>(network / range / allocation)"]

 NV -->|network_view| DV
 NV -->|network_view| IPAM
 DV -->|dns_view| ZA
 DV -->|dns_view| DREC
 ZA -->|zone must exist| DREC
 IPAM -.->|next_available_ip via cidr| DREC
 DREC -->|record_fqdns| DTC
 ZA -->|zone| DTC

 classDef this fill:#00B4D8,color:#fff,stroke:#0077A3,stroke-width:2px;
 class DREC this;

This module sits downstream of terraform-infoblox-dns-view and terraform-infoblox-zone-auth — the DNS view and the authoritative zone for every record's FQDN must already exist. Dynamic (cidr) A/AAAA/PTR records also depend on an IPAM network being present so NIOS can hand out the next-available address. The emitted record_fqdns map feeds DTC and monitoring.

flowchart TD
 subgraph MOD["terraform-infoblox-dns-records (aggregation — no this keystone)"]
 direction TB
 A["infoblox_a_record<br/>for_each a_records"]
 AAAA["infoblox_aaaa_record<br/>for_each aaaa_records"]
 PTR["infoblox_ptr_record<br/>for_each ptr_records"]
 CN["infoblox_cname_record<br/>for_each cname_records"]
 MX["infoblox_mx_record<br/>for_each mx_records"]
 TXT["infoblox_txt_record<br/>for_each txt_records"]
 SRV["infoblox_srv_record<br/>for_each srv_records"]
 NS["infoblox_ns_record<br/>for_each ns_records<br/>(no ttl/comment/ext_attrs)"]
 AL["infoblox_alias_record<br/>for_each alias_records"]
 end

 DV["dns_view (shared default)"] --> MOD
 TTL["default_ttl (shared default)"] --> MOD

 classDef rec fill:#00B4D8,color:#fff,stroke:#0077A3,stroke-width:1px;
 class A,AAAA,PTR,CN,MX,TXT,SRV,NS,AL rec;

Every box is a total for_each renderer over its collection. An empty collection ({}, the default) creates zero resources for that type — there is no overhead for record types you do not use.

The module declares only a required_providers block — no provider "infoblox" {} block. Grid connection details are configured at the root/pipeline level (see Quick Start).

⚠️ Zone & superuser callout. The authoritative zone for every record FQDN must exist before apply — the NIOS plugin cannot create DNS zones (use terraform-infoblox-zone-auth first). Record creation itself needs no superuser, but the Terraform Internal ID EA must exist; if your Terraform identity is a scoped DNS admin (not superuser), have a grid administrator pre-create all four EAs (below) before the first terraform apply, or apply fails with a WAPI/connection error.

These four Extensible Attributes must exist in the NIOS grid before terraform apply. They are added automatically by the Cloud Network Automation license, or created manually / via cURL:

Create the Terraform Internal ID EA via WAPI (adjust grid host / WAPI version as needed):

curl -k -u "$INFOBLOX_USERNAME:$INFOBLOX_PASSWORD" \
 -H "Content-Type: application/json" \
 -X POST "https://${INFOBLOX_SERVER}/wapi/v2.12.3/extensibleattributedef" \
 -d '{
 "name": "Terraform Internal ID",
 "type": "STRING",
 "flags": "CR",
 "comment": "Internal ID for Terraform drift detection"
 }'

• WAPI version: v2.12.3 (provider default; align with WAPI_VERSION).
• The CR flags mark the EA as Cloud-API created and Read-only so operators do not edit it by hand.

terraform-infoblox-dns-records/
├── providers.tf # required_providers only — NO provider {} block
├── variables.tf # dns_view, default_ttl + nine record collections
├── main.tf # nine for_each resources, no `this` keystone
├── outputs.tf # nine *_record_ids maps + merged record_fqdns
├── README.md # this file
└── SCOPE.md # in/out-of-scope resources, permissions, gotchas

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  dns_view = "default"

  a_records = {
    web01 = {
      fqdn    = "web01.corp.example.com"
      ip_addr = "10.20.30.10"
      comment = "Primary web node"
    }
  }

  cname_records = {
    www = {
      alias     = "www.corp.example.com"
      canonical = "web01.corp.example.com"
    }
  }
}

Wire the dns_view from the upstream DNS view module, and ensure the zone exists:

module "dns_view" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-view?ref=v1.0.0"
  name   = "corp-internal"
}

module "zone" {
  source   = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-auth?ref=v1.0.0"
  fqdn     = "corp.example.com"
  dns_view = module.dns_view.dns_view
}

module "dns_records" {
  source   = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"
  dns_view = module.dns_view.dns_view # ← wired here

  a_records = {
    web01 = { fqdn = "web01.corp.example.com", ip_addr = "10.20.30.10" }
  }

  depends_on = [module.zone] # zone must exist before records
}

Grid credentials (INFOBLOX_SERVER / INFOBLOX_USERNAME / INFOBLOX_PASSWORD, plus SSLMODE / WAPI_VERSION) are configured at the root / pipeline level — never inside this module.

All outputs are maps keyed by the caller's collection key — never null, empty {} when a collection is unused.

The primary identifier convention (id) is realised here as the per-type *_record_ids maps — the aggregation analogue of a single id output. Each WAPI ref is the canonical identifier for terraform import and ID-based wiring.

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  a_records = {
    web01 = {
      fqdn    = "web01.corp.example.com"
      ip_addr = "10.20.30.10"
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  a_records = {
    app01 = {
      fqdn         = "app01.corp.example.com"
      cidr         = "10.20.30.0/24" # next_available_ip drawn from here
      network_view = "default"
      comment      = "Dynamically allocated app node"
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  a_records = {
    web01 = {
      fqdn    = "web01.corp.example.com"
      ip_addr = "10.20.30.10"
      ext_attrs = {
        "Tenant ID"       = "corp"
        "CMP Type"        = "Terraform"
        "Cloud API Owned" = "True"
      }
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  aaaa_records = {
    web01_v6 = {
      fqdn      = "web01.corp.example.com"
      ipv6_addr = "2001:db8:abcd:12::10"
      ttl       = 3600
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  ptr_records = {
    rev_static = {
      ptrdname = "web01.corp.example.com" # reverse zone, static
      ip_addr  = "10.20.30.10"
    }
    rev_dynamic = {
      ptrdname     = "app01.corp.example.com" # reverse zone, dynamic
      cidr         = "10.20.30.0/24"
      network_view = "default"
    }
    fwd = {
      ptrdname    = "host.corp.example.com" # forward-mapping zone
      record_name = "alias.corp.example.com"
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  cname_records = {
    www = {
      alias     = "www.corp.example.com"
      canonical = "web01.corp.example.com"
      comment   = "Public alias for the primary web node"
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  mx_records = {
    primary = {
      fqdn           = "corp.example.com"
      mail_exchanger = "mail1.corp.example.com"
      preference     = 10
    }
    secondary = {
      fqdn           = "corp.example.com"
      mail_exchanger = "mail2.corp.example.com"
      preference     = 20
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  txt_records = {
    spf = {
      fqdn = "corp.example.com"
      text = "\"v=spf1 include:_spf.example.com -all\""
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  srv_records = {
    sip = {
      name     = "_sip._tcp.corp.example.com"
      target   = "sipserver.corp.example.com"
      port     = 5060
      priority = 10
      weight   = 50
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  ns_records = {
    sub = {
      name       = "sub.corp.example.com"
      nameserver = "ns1.corp.example.com"
      addresses = [
        { address = "10.20.30.5", auto_create_ptr = true },
        { address = "10.20.30.6" },
      ]
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  alias_records = {
    legacy = {
      name        = "legacy.corp.example.com"
      target_name = "web01.corp.example.com"
      target_type = "A" # one of: A, AAAA, MX, NAPTR, PTR, SPF, SRV, TXT
    }
  }
}

module "dns_records" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"

  default_ttl = 3600 # applies to all records below…

  a_records = {
    web01  = { fqdn = "web01.corp.example.com", ip_addr = "10.20.30.10" }             # inherits 3600
    cache0 = { fqdn = "cache.corp.example.com", ip_addr = "10.20.30.11", ttl = 0 }    # disables caching
    edge0  = { fqdn = "edge.corp.example.com", ip_addr = "10.20.30.12", ttl = 86400 } # explicit override
  }
}

module "dns_records" {
  source   = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"
  dns_view = "corp-internal"

  a_records = {
    internal = { fqdn = "app.corp.example.com", ip_addr = "10.0.0.5" }                      # corp-internal
    dmz      = { fqdn = "app.corp.example.com", ip_addr = "203.0.113.5", dns_view = "dmz" } # override
  }
}

output "web01_ref" {
  value = module.dns_records.a_record_ids["web01"] # e.g. record:a/ZG5z...:web01.corp.example.com/default
}

output "all_managed_names" {
  value = module.dns_records.record_fqdns # { "a:web01" = "web01.corp.example.com", "cname:www" = "www...",... }
}

module "dns_view" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-view?ref=v1.0.0"
  name   = "corp-internal"
}

module "zone" {
  source   = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-auth?ref=v1.0.0"
  fqdn     = "corp.example.com"
  dns_view = module.dns_view.dns_view
}

module "dns_records" {
  source     = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-records?ref=v1.0.0"
  dns_view   = module.dns_view.dns_view
  depends_on = [module.zone]

  default_ttl = 3600

  a_records = {
    web01 = { fqdn = "web01.corp.example.com", ip_addr = "10.20.30.10" }
    web02 = { fqdn = "web02.corp.example.com", ip_addr = "10.20.30.11" }
  }

  cname_records = {
    www = { alias = "www.corp.example.com", canonical = "web01.corp.example.com" }
  }

  mx_records = {
    primary = { fqdn = "corp.example.com", mail_exchanger = "mail1.corp.example.com", preference = 10 }
  }

  txt_records = {
    spf = { fqdn = "corp.example.com", text = "\"v=spf1 include:_spf.example.com -all\"" }
  }

  ptr_records = {
    web01 = { ptrdname = "web01.corp.example.com", ip_addr = "10.20.30.10" }
  }
}

Every name/FQDN-bearing field is validated lowercase (NIOS DNS is case-sensitive). See each variable's heredoc description in variables.tf for the full object schema.

WAPI reference string (the id convention). Each record's id is the NIOS object reference, e.g. record:a/ZG5zLnpvbmUkLl9kZWZhdWx0...:web01.corp.example.com/default. It is opaque, grid-specific, and is the canonical identifier for terraform import and reference-by-ID wiring. As an aggregation module there is no single id; the contract is realised as one { key => _ref } map per record type (a_record_ids, …) plus the merged record_fqdns.

NIOS object hierarchy. network_view → dns_view → zone (zone_auth) → record. This module owns only the leaf records. The DNS view (dns_view, default "default") and the authoritative zone for every FQDN must already exist — the plugin cannot create zones. Provision terraform-infoblox-dns-view and terraform-infoblox-zone-auth upstream.

Immutable fields (force-new). Renaming a record's identity (fqdn / alias / name / ptrdname) is a destroy-and-recreate. So is changing the map key — keys are the Terraform identity for each record and are immutable-by-convention; changing a key destroys and recreates that record. Switching a record between static (ip_addr/ipv6_addr) and dynamic (cidr) allocation also recreates it.

ext_attrs encoding. Callers pass a plain map(string). main.tf encodes per record:

ext_attrs = length(try(each.value.ext_attrs, {})) > 0 ? jsonencode(each.value.ext_attrs) : null

The length(...) > 0 guard is required because the provider expects a JSON string, not a map. Encoding an empty map would render "{}", which the provider then reports as perpetual drift on every plan; encoding to null omits the argument entirely so unused EAs stay quiet. ns_records has no ext_attrs — the NIOS NS-record object exposes none.

TTL behavior. Resolution per record is: per-record ttl wins, else module-level default_ttl. Then null (both unset) → inherit from the parent zone (NIOS stores this as a negative value in state, by design — not drift); 0 → disable caching for the record; positive integer → explicit TTL in seconds. A per-record ttl = 0 is honoured because 0 != null. ns_records has no ttl — the NS-record object has no TTL field.

Terraform Internal ID EA (drift detection). When present (auto-created under a superuser identity, or pre-created), the provider stamps this EA onto every managed record so it can re-locate the object if the NIOS _ref changes due to out-of-band manual edits — preventing spurious destroy/recreate churn. Pre-create it if your identity is not superuser.

Case sensitivity — lowercase FQDNs only. NIOS DNS lookups are case-sensitive; capital letters cause silent lookup failures. Every name/FQDN-bearing field across all nine collections is validated lowercase (fqdn, alias, canonical, ptrdname, record_name, mail_exchanger, SRV name/target, NS name/nameserver, alias name/target_name). TXT text is the one exception — TXT data is arbitrary and not case-folded.

Eventual consistency. NIOS is a distributed grid with read-after-write lag; a freshly created record may not be immediately queryable. Allow brief propagation before dependent reads in tightly chained pipelines.

• Aggregation, not nine modules — DNS records share an identical shape and are provisioned together; one module with nine optional collections is the right boundary.
• No this keystone — every resource is named by role (a_records, cname_records, …) and driven by for_each. No count.
• Each collection independently optional — map(object(...)) default {}, so callers populate only what they need.
• Shared defaults + per-record overrides — module-level dns_view/default_ttl avoid repetition while preserving per-record control.
• Map-of-maps outputs keyed by the caller's key — deterministic wiring; an unused collection yields {}, never an error.
• ext_attrs is the NIOS equivalent of tags — map(string), jsonencoded, guarded against "{}" drift. No Azure tags/resource_group_name/object_id.
• NS-record exception surfaced — ns_records omits ttl/comment/ext_attrs because the WAPI object has none.
• Host records excluded — infoblox_ip_allocation (host record) is a distinct family owned by terraform-infoblox-ip-allocation.

terraform init -backend=false
terraform validate
terraform fmt -check

terraform plan / apply require a live NIOS grid endpoint and the auth env vars (INFOBLOX_SERVER / INFOBLOX_USERNAME / INFOBLOX_PASSWORD). init -backend=false + validate + fmt -check run fully offline.

• Offline: terraform init -backend=false && terraform validate && terraform fmt -check — confirms schema, type, and validation-block correctness without a grid.
• Validation coverage to exercise: lowercase enforcement on every FQDN field; A/AAAA ip_addr vs cidr mutual exclusion; PTR exactly-one-of record_name/ip_addr/cidr; MX preference 0–65535; SRV port/priority/weight ranges; alias target_type enum; NS non-empty addresses.
• Integration (against a lab grid): stand up dns_view + zone_auth, then apply a small mix of record types and assert the *_record_ids maps are populated and record_fqdns is correctly namespaced.
• Idempotence: a second plan after apply must report no changes — in particular no ext_attrs "{}" drift and no TTL-inherit (negative value) churn.

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

a_record_ids = {
 "web01" = "record:a/ZG5zLmJpbmRfYSQuX2RlZmF1bHQ...:web01.corp.example.com/default"
}
cname_record_ids = {
 "www" = "record:cname/ZG5zLmJpbmRfY25hbWUk...:www.corp.example.com/default"
}
mx_record_ids = {}
record_fqdns = {
 "a:web01" = "web01.corp.example.com"
 "cname:www" = "www.corp.example.com"
}

• Provider: infobloxopen/infoblox — infoblox_*_record resources
• Infoblox NIOS documentation
• SCOPE.md (this module) — in/out-of-scope resources, permissions, prerequisites, gotchas, design decisions
• Upstream: terraform-infoblox-dns-view, terraform-infoblox-zone-auth
• Downstream: terraform-infoblox-dtc (consumes record_fqdns)

💙 "Infrastructure as Code should be standardized, consistent, and secure."