Terraform resource reference

Every resource the DTM provider exposes, with its required role and import format. See provider setup for installation and authentication.

Provider configuration

provider "dtm" {
  endpoint = "https://dtm.internal:8443" # or DTM_ENDPOINT
  token    = var.dtm_token               # or DTM_TOKEN (sensitive)
  # insecure_skip_verify = true          # dev only
}

Resources

Resource	Role	Import ID	Docs
dtm_zone	editor	<zone_id>	Zones and records
dtm_record	editor	<zone_id>:<record_id>	Zones and records
dtm_auto_record	editor	<zone_id>:<record_id>	Auto-populated records
dtm_override_record	editor	<override_id>	ALIAS and overrides
dtm_healthcheck	editor	<id>	Health and LB
dtm_forwarder	editor	<id>	Forwarding
dtm_default_forwarder	editor	default (singleton)	Forwarding
dtm_stub_zone	editor	<id>	Forwarding
dtm_blocklist	editor	blocklist (singleton)	Forwarding
dtm_tsig_key	editor	<name>	Forwarding
dtm_subnet_mapping	editor	<id>	Regions
dtm_discovery_scope	admin	<id>	Regions
dtm_dynamic_dns_config	admin	dynamic-dns (singleton)	Forwarding
dtm_axfr_config	admin	axfr (singleton)	Forwarding
dtm_forwarder_hardening_config	admin	forwarder-hardening (singleton)	Forwarding
dtm_otlp_config	admin	otlp (singleton)	Cluster config
dtm_rate_limit_config	admin	rate-limits (singleton)	Cluster config
dtm_cache_config	admin	cache (singleton)	Cluster config
dtm_replication_config	admin	replication (singleton)	Cluster config
dtm_health_probe_policy_config	admin	health-probe-policy (singleton)	Health and LB
dtm_delete_guardrail_config	admin	delete-guardrails (singleton)	Cluster config
dtm_region_discovery_config	admin	region-discovery (singleton)	Regions
dtm_transport_config	admin	transport-config (singleton)	Cluster config
dtm_query_log_config	admin	query-log (singleton)	Cluster config
dtm_service_account	admin	By account ID (token stays out of state)	Provider setup
dtm_service_account_token	admin	(ephemeral; opened per run, never in state)	Provider setup
dtm_user	admin	<username> (password stays out of state)	Cluster config
dtm_sso_config	admin	sso (singleton; secret stays out of state)	Cluster config

Data sources

Data source	Returns
dtm_zone	Look up a zone by name (id, default_ttl, status).
dtm_nodes	All cluster members (id, name, addr, region_id, status, version).
dtm_regions	Deduplicated region IDs in use.
dtm_cluster_info	Cluster summary (version, node_count, alive_count, node_id, region_id).
dtm_management_group_expansion	Expands a management group into readable/unreadable member subscriptions, with an optional per-subscription verify probe (admin only). See regions and discovery.

Notes on specific resources

• Singletons (marked “singleton” above) all import with fixed IDs, but only dtm_default_forwarder, dtm_blocklist, dtm_transport_config, dtm_axfr_config, and dtm_query_log_config are one per cluster (replicated); the remaining config singletons exist per node, and a Terraform apply reaches only the endpoint node. “Deleting” a singleton resets its configuration rather than removing anything.
• Replace-only resources. dtm_subnet_mapping and dtm_tsig_key have no update path: every attribute forces replacement. For dtm_tsig_key, use lifecycle { create_before_destroy = true } to rotate without a gap. Import a TSIG key by its name, not its ID.
• Apply-on-restart. dtm_replication_config persists on apply but takes effect on the next restart of the node the provider endpoint targets; apply it through every node’s endpoint (or set the YAML on all nodes) before the rolling restart, or the cluster runs mixed timings. The pending values are expected, not drift.
• FQDN attributes (name on dtm_zone, domain on dtm_forwarder / dtm_stub_zone, fqdn on dtm_override_record) want a trailing dot. One exception: the dtm_zone data source looks a zone up case-insensitively and with or without the trailing dot.
• Secrets. secret (dtm_tsig_key), dtm_otlp_config header values, and health-probe credentials (client_secret, key_pem, and probe headers values on health_check_template and dtm_healthcheck) are never returned in cleartext by the API; the provider preserves the values you applied in state so plans stay clean. They are also marked sensitive, so Terraform hides them in plan output. Keep the source of truth in your own variables or secret store. After a terraform import, run one apply to replace the redacted placeholders with your real values.

Roles at a glance

Create a dedicated Terraform user with the least role it needs (see users and access):

• editor is enough for DNS data-plane resources (zones, records, ALIAS, overrides, health checks, forwarders, stub zones, blocklist, subnet mappings, TSIG keys).
• admin is required for the config singletons in the table above (most are per-node; see the Notes) and Azure discovery scopes.