DNS access control (IAM)
DNS uses two IAM resources: dns_zone and dns_record.
Built-in policies
| Policy name | Slug | Typical use |
|---|---|---|
dns:ReadAccess | dns-read-access | View zones and records |
dns:FullAccess | dns-full-access | Create, update, and delete zones and records |
See DNS default policies for the full permission matrix.
Record operations require permissions on both the zone and the record. Bind policies via organisation roles or project IAM policies.
The built-in admin:all policy grants full DNS access implicitly.
Permission reference
| Resource | Typical permissions | Operations |
|---|---|---|
dns_zone | read, list | List and view zones; read DNSSEC status |
dns_zone | create, update, delete | Create, update, or delete zones; enable or disable DNSSEC |
dns_record | read, list | List and view records in a zone |
dns_record | create, update, delete | Create, update, or delete records |
Related documentation
- DNS zones — Zone and record management
- DNSSEC — Signing permissions on
dns_zone - Permission rules — Resource types and rule structure
- API reference — Required headers including
X-Project-Identity