Terraform resource reference

Every resource the DTM provider exposes, with its required role and import format. See provider setup for installation and authentication.

Provider configuration

provider "dtm" {
  endpoint = "https://dtm.internal:8443" # or DTM_ENDPOINT
  token    = var.dtm_token               # or DTM_TOKEN (sensitive)
  # insecure_skip_verify = true          # dev only
}

Resources

Resource	Role	Import ID	Docs
dtm_zone	editor	<zone_id>	Zones and records
dtm_record	editor	<zone_id>:<record_id>	Zones and records
dtm_auto_record	editor	<zone_id>:<record_id>	Auto-populated records
dtm_override_record	editor	<override_id>	ALIAS and overrides
dtm_healthcheck	editor	<id>	Health and LB
dtm_script	admin	<id>	Managed script checks
dtm_forwarder	editor	<id>	Forwarding
dtm_default_forwarder	editor	default (singleton)	Forwarding
dtm_stub_zone	editor	<id>	Forwarding
dtm_blocklist	editor	blocklist (singleton)	Forwarding
dtm_tsig_key	editor	<name>	Forwarding
dtm_subnet_mapping	editor	<id>	Regions
dtm_discovery_scope	admin	<id>	Regions
dtm_dynamic_dns_config	admin	dynamic-dns (singleton)	Forwarding
dtm_axfr_config	admin	axfr (singleton)	Forwarding
dtm_forwarder_hardening_config	admin	forwarder-hardening (singleton)	Forwarding
dtm_otlp_config	admin	otlp (singleton)	Cluster config
dtm_rate_limit_config	admin	rate-limits (singleton)	Cluster config
dtm_cache_config	admin	cache (singleton)	Cluster config
dtm_replication_config	admin	replication (singleton)	Cluster config
dtm_health_probe_policy_config	admin	health-probe-policy (singleton)	Health and LB
dtm_delete_guardrail_config	admin	delete-guardrails (singleton)	Cluster config
dtm_region_discovery_config	admin	region-discovery (singleton)	Regions
dtm_transport_config	admin	transport-config (singleton)	Cluster config
dtm_query_log_config	admin	query-log (singleton)	Cluster config
dtm_backup_config	admin	backup (singleton)	Backup and restore
dtm_private_endpoint_config	admin	private-endpoints (singleton)	Private endpoints
dtm_tag_registration_config	admin	tag-registration (singleton)	VM registration
dtm_azure_monitor_config	admin	azure-monitor (singleton)	Observability
dtm_terraform_mirror_config	admin	terraform-mirror (singleton)	Provider setup
dtm_tls_certificate	admin	tls-certificate (singleton)	TLS certificates
dtm_service_account	admin	By account ID (token stays out of state)	Provider setup
dtm_service_account_token	admin	(ephemeral; opened per run, never in state)	Provider setup
dtm_user	admin	<username> (password stays out of state)	Cluster config
dtm_sso_config	admin	sso (singleton; secret stays out of state)	Cluster config

Data sources

Data source	Returns
dtm_zone	Look up a zone by name (id, default_ttl, status).
dtm_nodes	All cluster members (id, name, addr, region_id, status, version).
dtm_regions	Deduplicated region IDs in use.
dtm_cluster_info	Cluster summary (version, node_count, alive_count, node_id, region_id).
dtm_management_group_expansion	Expands a management group into readable/unreadable member subscriptions, with an optional per-subscription verify probe (admin only). See regions and discovery.

Notes on specific resources

• Singletons (marked “singleton” above) all import with fixed IDs, but only dtm_default_forwarder, dtm_blocklist, dtm_transport_config, dtm_axfr_config, dtm_query_log_config, dtm_terraform_mirror_config, dtm_tag_registration_config, and dtm_tls_certificate are one per cluster (replicated); the remaining config singletons exist per node, and a Terraform apply reaches only the endpoint node. dtm_azure_monitor_config needs admin for reads as well as writes. Do not bootstrap with dtm_terraform_mirror_config: the mirror is what lets terraform init install the provider, so turn it on first (see provider setup) and manage it as code afterwards; destroying it turns the mirror off. “Deleting” a singleton resets its configuration rather than removing anything.
• Replace-only resources. dtm_subnet_mapping has no update path: every attribute forces replacement. (dtm_tsig_key changes zone_ids and its secret in place; only name and algorithm force replacement. Import a TSIG key by its name, not its ID.)
• Apply-on-restart. dtm_replication_config, dtm_backup_config, and dtm_azure_monitor_config persist on apply but take effect on the next restart of the node the provider endpoint targets. For replication timing, apply it through every node’s endpoint (or set the YAML on all nodes) before the rolling restart, or the cluster runs mixed timings. The pending values are expected, not drift.
• FQDN attributes (name on dtm_zone, domain on dtm_forwarder / dtm_stub_zone, fqdn on dtm_override_record) want a trailing dot. One exception: the dtm_zone data source looks a zone up case-insensitively and with or without the trailing dot.
• Secrets. The TSIG secret is the write-only secret_wo (dtm_tsig_key), which never reaches state; the deprecated secret is stored in state. The TLS private key is the write-only key_pem_wo (dtm_tls_certificate, Terraform 1.11 or later), which never reaches state or plan. dtm_otlp_config header values and health-probe credentials (client_secret, key_pem, and probe headers values on health_check_template and dtm_healthcheck) are never returned in cleartext by the API; the provider preserves the values you applied in state so plans stay clean. They are also marked sensitive, so Terraform hides them in plan output. Keep the source of truth in your own variables or secret store. After a terraform import, run one apply to replace the redacted placeholders with your real values.

Roles at a glance

Create a dedicated Terraform user with the least role it needs (see users and access):

• editor is enough for DNS data-plane resources (zones, records, ALIAS, overrides, health checks, forwarders, stub zones, blocklist, subnet mappings, TSIG keys).
• admin is required for the config singletons in the table above (most are per-node; see the Notes) and Azure discovery scopes.