feat(cloud-dns): DNSSEC enabled by default for public zones

infrastructure/gcp/cloud-dns/README.md

@@ -49,7 +49,7 @@ resource "example_resource" "this" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | >= 5.0, < 7.0 |
+| <a name="provider_google"></a> [google](#provider\_google) | 6.50.0 |
 
 ## Resources
 
@@ -61,6 +61,7 @@ resource "example_resource" "this" {
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_dnssec_enabled"></a> [dnssec\_enabled](#input\_dnssec\_enabled) | Enable DNSSEC for the zone. Only applies to public zones; signing is inert until the DS record is published at the domain registrar. | `bool` | `true` | no |
 | <a name="input_domain_name"></a> [domain\_name](#input\_domain\_name) | The domain name for the DNS zone (without trailing dot, e.g. example.com) | `string` | n/a | yes |
 | <a name="input_private_zone_networks"></a> [private\_zone\_networks](#input\_private\_zone\_networks) | VPC network self-links for private zones | `list(string)` | `[]` | no |
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The GCP project ID | `string` | n/a | yes |

infrastructure/gcp/cloud-dns/main.tf

@@ -8,6 +8,13 @@ resource "google_dns_managed_zone" "zone" {
   dns_name   = "${var.domain_name}."
   visibility = var.visibility
 
+  dynamic "dnssec_config" {
+    for_each = var.visibility == "public" && var.dnssec_enabled ? [1] : []
+    content {
+      state = "on"
+    }
+  }
+
   dynamic "private_visibility_config" {
     for_each = var.visibility == "private" ? [1] : []
     content {

infrastructure/gcp/cloud-dns/tests/cloud_dns.tftest.hcl

@@ -74,3 +74,39 @@ run "labels_applied_from_tags" {
     error_message = "Labels should be applied from tags variable"
   }
 }
+
+run "dnssec_enabled_by_default_on_public_zone" {
+  command = plan
+
+  assert {
+    condition     = google_dns_managed_zone.zone.dnssec_config[0].state == "on"
+    error_message = "DNSSEC should be on by default for public zones"
+  }
+}
+
+run "dnssec_can_be_disabled" {
+  command = plan
+
+  variables {
+    dnssec_enabled = false
+  }
+
+  assert {
+    condition     = length(google_dns_managed_zone.zone.dnssec_config) == 0
+    error_message = "DNSSEC should not be configured when dnssec_enabled is false"
+  }
+}
+
+run "dnssec_ignored_on_private_zone" {
+  command = plan
+
+  variables {
+    visibility     = "private"
+    dnssec_enabled = true
+  }
+
+  assert {
+    condition     = length(google_dns_managed_zone.zone.dnssec_config) == 0
+    error_message = "DNSSEC should not be configured on private zones even when dnssec_enabled is true"
+  }
+}

infrastructure/gcp/cloud-dns/variables.tf

@@ -26,6 +26,12 @@ variable "private_zone_networks" {
   default     = []
 }
 
+variable "dnssec_enabled" {
+  type        = bool
+  description = "Enable DNSSEC for the zone. Only applies to public zones; signing is inert until the DS record is published at the domain registrar."
+  default     = true
+}
+
 variable "tags" {
   type        = map(string)
   description = "A mapping of labels to assign to the DNS managed zone"