Google Cloud

resource "google_dns_managed_zone" "securd_forward" {
  name       = "securd-agents"
  dns_name   = "."
  visibility = "private"
  private_visibility_config {
    networks { network_url = google_compute_network.agents.id }
  }
  forwarding_config {
    target_name_servers { ipv4_address = var.securd_primary }
    target_name_servers { ipv4_address = var.securd_secondary }
  }
}

resource "google_compute_firewall" "deny_other_dns" {
  name      = "deny-other-dns"
  network   = google_compute_network.agents.name
  direction = "EGRESS"
  priority  = 900
  deny { protocol = "udp" ports = ["53"] }
  deny { protocol = "tcp" ports = ["53"] }
  destination_ranges = ["0.0.0.0/0"]
}

resource "google_compute_firewall" "allow_securd_dns" {
  name      = "allow-securd-dns"
  network   = google_compute_network.agents.name
  direction = "EGRESS"
  priority  = 800
  allow { protocol = "udp" ports = ["53"] }
  allow { protocol = "tcp" ports = ["53"] }
  destination_ranges = ["${var.securd_primary}/32", "${var.securd_secondary}/32"]
}