Google Cloud DNS
Cloud DNS service account key setup: create a service account in the project that owns your Cloud DNS zones, grant its DNS role, and paste the downloaded JSON key.
On this page
Cloud DNS service account key permissions
- Credential type
- service account JSON key
- Preview access
- DNS Reader (roles/dns.reader)
- Apply access
- DNS Administrator (roles/dns.admin)
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "GCLOUD"
}Create credentials
Create a service account in the project that owns your Cloud DNS zones, grant its DNS role, and paste the downloaded JSON key.
Access you'll grant
DNS Reader (roles/dns.reader)
DNS Administrator (roles/dns.admin)
Before you start
- A Google Cloud project containing the Cloud DNS zones you want to use.
- Permission to enable the Cloud DNS API, create a service account and key, and grant project IAM roles. The relevant predefined role IDs are roles/serviceusage.serviceUsageAdmin, roles/iam.serviceAccountCreator, roles/iam.serviceAccountKeyAdmin, and roles/resourcemanager.projectIamAdmin.
- Your organization policy must allow user-managed service account keys. Organizations created on or after May 3, 2024 enforce iam.disableServiceAccountKeyCreation by default.
- User-managed keys don't expire by default, but an organization policy can set an expiry. Rotate or disable the key under your organization's credential policy.
Setup steps
0 of 5 done
Enable the Cloud DNS API
Select the project that owns the zones, open the Cloud DNS API page, and select Enable if the API isn't already enabled.
Create a service account
Open IAM & Admin → Service Accounts → Create service account. Enter
DNSMigratoras the Service account name, keep the generated ID, and select Create and continue.Service account nameDNSMigratorGrant Cloud DNS access
Under Grant this service account access to project, choose DNS Reader for preview-only access or DNS Administrator for apply. Select Continue, then Done.
Preview role IDroles/dns.readerApply role IDroles/dns.adminCreate a JSON key
On Service Accounts, select the service account's email, open Keys, then choose Add key → Create new key. Select JSON as Key type and choose Create. The browser downloads the only copy of the private key; Google can't show or download it again.
Key typeJSONPaste the downloaded key
Open the downloaded
.jsonfile in a local text editor and paste the complete object into Service account key (JSON). Leave Project ID blank to use the key'sproject_id. If the service account was created in one project but the zones are in another, grant the DNS role in the zone project and enter that target project's ID.
Troubleshooting
Cloud DNS API is disabled or hasn't been used in the project
Open the Cloud DNS API link in step 1 with the target project selected and choose Enable, then check access again.
Service account key creation is disabled
An organization policy is enforcing iam.disableServiceAccountKeyCreation. Ask an organization policy administrator for an approved project exemption; DNSMigrator's current form doesn't accept Workload Identity Federation credentials.
Google rejects the service account key
Paste the entire downloaded JSON object without editing private_key or its escaped newlines. Check that the key and service account are still enabled; create a replacement key if the original was deleted or expired by policy.
The zone list is empty or Google returns permission denied
Select the project containing the zones, grant roles/dns.reader or roles/dns.admin there, and enter that Project ID when it differs from project_id in the key.
Official documentation
- Create and delete service account keys
- Create service accounts
- Cloud DNS roles and permissions
- Cloud DNS quickstart and API enablement
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Service account key (JSON)serviceAccount | Required | The complete JSON file downloaded from Service Accounts → your account → Keys → Add key → Create new key. It must contain client_email and the full private_key value. |
| Project IDprojectId | Optional | Optional target Google Cloud Project ID. Leave blank to use project_id from the JSON key; for cross-project access, use the project containing the Cloud DNS zones, not the service account's home project. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- 0 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- DS
- HTTPS
- SVCB
- TLSA
- SSHFP
- NAPTR
- SPF
Caveats
- Routing policies (weighted round robin, geolocation, failover) don't carry over to most providers.
- Apex CNAMEs are not allowed.
Troubleshooting
- Cloud DNS API is disabled or hasn't been used in the project
- Open the Cloud DNS API link in step 1 with the target project selected and choose Enable, then check access again.
- Service account key creation is disabled
- An organization policy is enforcing iam.disableServiceAccountKeyCreation. Ask an organization policy administrator for an approved project exemption; DNSMigrator's current form doesn't accept Workload Identity Federation credentials.
- Google rejects the service account key
- Paste the entire downloaded JSON object without editing private_key or its escaped newlines. Check that the key and service account are still enabled; create a replacement key if the original was deleted or expired by policy.
- The zone list is empty or Google returns permission denied
- Select the project containing the zones, grant roles/dns.reader or roles/dns.admin there, and enter that Project ID when it differs from project_id in the key.