🟦 Infoblox NIOS Delegated Zone Terraform Module

Creates and manages a single NIOS delegated DNS zone (infoblox_zone_delegated / WAPI zone_delegated) — hands authority for a subzone off to a set of remote name servers or to a NIOS name server group. Built for infoblox v2.x / WAPI v2.12.3.

[] [] []

• 🟦 Wraps the single infoblox_zone_delegated resource named this — no provider block, no credentials.
• 🤝 Delegates authority for a subzone to either explicit remote name servers (delegate_to) or a NIOS name server group (ns_group) — exactly one, enforced at plan time.
• 🌐 Supports forward delegations (FORWARD) and reverse delegations (IPV4 / IPV6, fqdn in address/cidr form).
• 🕒 Exposes the delegation TTL (delegated_ttl) as the universal ttl input — null inherits, 0 disables caching.
• 🏷️ Universal NIOS fields: optional comment and ext_attrs (map(string), JSON-encoded only when non-empty), plus operational disable / locked flags whose defaults match the provider's (no drift).
• 🔗 Emits the WAPI reference id plus fqdn / dns_view shaped exactly as sibling DNS modules consume them.

💡 Why it matters: A delegated zone is how NIOS cedes responsibility for a subzone (e.g. a cloud provider's aws.example.com) to external authoritative servers while keeping the parent zone in the grid. The delegated zone must be a subzone of an existing authoritative zone — see Architecture Notes.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

This module consumes a dns_view (from terraform-infoblox-dns-view) and emits id / fqdn / dns_view for sibling DNS modules and operational tooling (see 🔌 Typical wiring below); the delegated fqdn must fall under an existing authoritative zone (terraform-infoblox-zone-auth), wired via depends_on.

flowchart TD
 NV["terraform-infoblox-network-view<br/>(network_view)"]
 DV["terraform-infoblox-dns-view<br/>(dns_view)"]
 ZA["terraform-infoblox-zone-auth<br/>(parent authoritative zone)"]
 ZD["terraform-infoblox-zone-delegated<br/>(this module — WAPI zone_delegated)"]

 NV -->|network_view| DV
 DV -->|dns_view| ZA
 DV -->|dns_view| ZD
 ZA -.must be a subzone of.-> ZD

 classDef me fill:#00B4D8,color:#fff,stroke:#0077A3,stroke-width:2px;
 class ZD me;

One resource — infoblox_zone_delegated.this — a thin renderer over the WAPI zone_delegated object. Delegation is via delegate_to (a dynamic block) XOR ns_group; fqdn / dns_view / zone_format are immutable.

flowchart TD
 IN["fqdn (immutable, lowercase)<br/>dns_view / zone_format (immutable)<br/>delegation target: delegate_to (dynamic) XOR ns_group<br/>ttl / disable / locked / comment / ext_attrs"]
 THIS["infoblox_zone_delegated.this<br/>(WAPI zone_delegated — delegated DNS subzone)"]
 ID["id (WAPI _ref, e.g. zone_delegated/...)"]
 OUT["fqdn / dns_view / delegate_to / ns_group"]

 IN --> THIS
 THIS --> ID
 THIS --> OUT

 classDef me fill:#00B4D8,color:#fff,stroke:#0077A3,stroke-width:2px;
 class THIS me;

terraform-infoblox-zone-delegated/
├── providers.tf # required_providers only — no provider {} block
├── variables.tf # fqdn, dns_view, delegate_to, ns_group, zone_format, disable, locked, comment, ext_attrs, ttl
├── main.tf # single resource infoblox_zone_delegated.this
├── outputs.tf # id (primary), fqdn, dns_view, zone_format, delegate_to, ns_group, ttl, comment
├── README.md
└── SCOPE.md

module "delegated_aws_example_com" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "aws.example.com"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
    { name = "ns-2034.awsdns-62.co.uk", address = "10.10.1.1" },
  ]
}

Place the delegation in a non-default view by wiring dns_view from the DNS-view module:

module "delegated_aws_example_com" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn     = "aws.example.com"
  dns_view = module.dns_view_external.dns_view # from terraform-infoblox-dns-view

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

⚠️ Superuser callout: The Terraform Internal ID EA (read-only, CR flag) can only be auto-created by a superuser. If your Terraform identity is not superuser, an administrator must pre-create all four EAs (see Prerequisites below) before the first terraform apply, or the apply fails with a connection/EA error. The infoblox_ip_allocation / infoblox_ip_association resources (a separate module) likewise require superuser — this zone_delegated module does not.

These four Extensible Attributes must exist on the grid before terraform apply. They are installed automatically by the Cloud Network Automation license, or created manually / via cURL.

Create the Terraform Internal ID EA via WAPI (target WAPI v2.12.3):

curl -k -u "$INFOBLOX_USERNAME:$INFOBLOX_PASSWORD" \
 -H "Content-Type: application/json" \
 -X POST "https://$INFOBLOX_SERVER/wapi/v2.12.3/extensibleattributedef" \
 -d '{
 "name": "Terraform Internal ID",
 "type": "STRING",
 "flags": "CR",
 "comment": "Internal ID for Terraform Resource"
 }'

The other three EAs are created the same way ("type": "STRING" for Tenant ID / CMP Type; "type": "ENUM" with list_values True/False for Cloud API Owned).

WAPI reference string (id output). The primary id is the NIOS WAPI object reference, not a UUID. For a delegated zone it looks like:

zone_delegated/ZG5zLnpvbmUkLl9kZWZhdWx0LmNvbS5leGFtcGxlLmF3cw:aws.example.com/default

The opaque base64-like segment is the object handle; the trailing name/view is human-readable. Use this string for terraform import and for any reference-by-ID wiring.

Immutable / force-new fields.

• fqdn — NIOS does not allow a delegated-zone name to change. Editing it forces destroy + recreate. Choose it carefully before the first apply.
• zone_format — for reverse zones the format is tied to the fqdn CIDR; since fqdn cannot change, zone_format is immutable in practice. Set it correctly for IPV4 / IPV6 delegations up front.

Delegated zone must be a subzone of an authoritative zone. NIOS only accepts a delegated zone whose fqdn falls under an existing authoritative zone (e.g. aws.example.com requires the example.com zone_auth to exist). Create the parent with terraform-infoblox-zone-auth first, or the WAPI rejects the create.

Exactly one delegation target. NIOS requires either delegate_to (one or more remote name servers) or ns_group — never both, never neither. The module enforces this with a cross-field XOR validation on delegate_to so the misconfiguration is caught at plan time, not by the WAPI:

condition = (length(var.delegate_to) > 0) != (var.ns_group != null)

The delegate_to block is rendered with a dynamic block driven by the list; when the list is empty the block is omitted entirely and delegation is governed by ns_group.

Lowercase-only FQDNs. NIOS DNS lookups are case-sensitive. A capital letter in fqdn (or in any delegate_to[*].name) produces a delegation that appears to fail to resolve. The module enforces var.fqdn == lower(var.fqdn) and the same rule on each delegate_to[*].name with validation {} blocks — keep all zone names and name-server FQDNs lowercase.

ext_attrs JSON-encoding & the length > 0 guard. Callers always pass a plain map(string); the module encodes it for the provider:

ext_attrs = length(var.ext_attrs) > 0 ? jsonencode(var.ext_attrs) : null

The provider's ext_attrs argument is a JSON string, so jsonencode is required. The length > 0 guard sends null (argument omitted) for an empty map rather than the string "{}" — without it, an unused EA map shows up as perpetual drift on every subsequent plan.

TTL behaviour (ttl → provider delegated_ttl).

• null / omitted → inherit (the provider's ttlUndef). This surfaces in Terraform state as a negative value such as -1 — that is expected, not drift.
• 0 → disable caching for this delegation.
• positive integer → explicit TTL in seconds.

The provider field is named delegated_ttl; the module exposes it as the universal ttl for consistency across the terraform-infoblox-* suite, and the ttl output re-emits the provider value (a negative number signals the inherited/unset state).

Terraform Internal ID EA & drift detection. On first apply the provider stamps the delegated zone with the Terraform Internal ID EA. If a NIOS admin manually changes the object such that its WAPI reference changes, Terraform uses this stable internal ID (not the volatile ref) to re-locate the object and detect drift instead of proposing a spurious recreate. The EA is not written to terraform.tfstate and must never be placed in a normal ext_attrs block.

Eventual consistency. The NIOS WAPI is eventually consistent — a read immediately following a create may not see the delegated zone. Re-plan, allow a brief settle, or sequence dependent modules with depends_on.

module "delegated_minimal" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "aws.example.com"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_multi_ns" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "aws.example.com"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
    { name = "ns-2034.awsdns-62.co.uk", address = "10.10.1.1" },
    { name = "ns-0917.awsdns-52.net", address = "10.20.1.1" },
  ]
}

module "delegated_with_comment" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn    = "cloud.example.com"
  comment = "Cloud subzone delegated to provider DNS — managed by Terraform"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_with_eas" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "prod.example.com"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]

  # Callers pass a plain map(string). The module runs jsonencode internally.
  ext_attrs = {
    "Tenant ID"       = "prod"
    "CMP Type"        = "Terraform"
    "Cloud API Owned" = "True"
  }
}

module "delegated_external_view" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn     = "aws.example.com"
  dns_view = "external"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_via_nsgroup" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn     = "lab.example.com"
  ns_group = "demoGroup" # must already exist on the grid; omit delegate_to entirely
}

module "delegated_reverse_v4" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn        = "10.1.0.0/24" # address/cidr form for reverse zones
  zone_format = "IPV4"
  comment     = "Reverse delegation for 10.1.0.0/24"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_reverse_v6" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn        = "3001:db8::/64"
  zone_format = "IPV6"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_with_ttl" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "aws.example.com"
  ttl  = 3600 # 1h; maps to the provider's delegated_ttl

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_no_cache" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn = "aws.example.com"
  ttl  = 0 # disable caching; omit ttl entirely (null) to inherit instead

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_disabled_locked" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn    = "staging.example.com"
  disable = true # not served while disabled
  locked  = true # restrict conflicting admin changes (continues serving DNS data)

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]
}

module "delegated_full" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn        = "complete.example.com"
  dns_view    = "internal"
  zone_format = "FORWARD"
  disable     = false
  locked      = false
  ttl         = 1800
  comment     = "Fully specified delegated zone"

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
    { name = "ns-2034.awsdns-62.co.uk", address = "10.10.1.1" },
  ]

  ext_attrs = {
    "Tenant ID"       = "shared-services"
    "CMP Type"        = "Terraform"
    "Cloud API Owned" = "True"
  }
}

module "dns_view_external" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-dns-view?ref=v1.0.0"

  name = "external"
}

# The delegated zone must be a subzone of an existing authoritative zone.
module "zone_example_com" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-auth?ref=v1.0.0"

  fqdn     = "example.com"
  dns_view = module.dns_view_external.dns_view
}

module "delegated_aws_example_com" {
  source = "git::https://github.com/microsoftexpert/terraform-infoblox-zone-delegated?ref=v1.0.0"

  fqdn     = "aws.example.com"
  dns_view = module.zone_example_com.dns_view # same view as the parent zone

  delegate_to = [
    { name = "ns-1488.awsdns-58.org", address = "10.1.1.1" },
  ]

  depends_on = [module.zone_example_com] # parent authoritative zone must exist first
}

Delegation rule: exactly one of delegate_to (non-empty) or ns_group must be set — enforced by an XOR validation {} on delegate_to.

• Single resource named this — one infoblox_zone_delegated, four files, no provider block.
• House variable order — fqdn → dns_view → delegation target → optional config → universal NIOS fields.
• Deeply-typed delegate_to object — list(object({ name, address })); no loose map/any.
• Closed value sets validated — zone_format, the lowercase fqdn / delegate_to[*].name rules, and the delegate_to ⊕ ns_group XOR are all enforced with validation {}.
• Universal NIOS fields — comment + ext_attrs present, ext_attrs JSON-encoded with the length > 0 guard; DNS ttl exposed (maps to delegated_ttl).
• Provider-matching defaults — disable / locked default to false so unset = no drift.
• No Azure idioms — no tags, no resource_group_name, no object_id; the primary output is the WAPI id.
• Credentials never in the module — grid auth is root/pipeline-level env vars only.

terraform init -backend=false
terraform validate
terraform fmt -check

ℹ️ terraform plan / apply require a live NIOS grid endpoint (INFOBLOX_SERVER / INFOBLOX_USERNAME / INFOBLOX_PASSWORD), the four EAs in place, and an existing authoritative parent zone. init -backend=false / validate / fmt -check run offline.

• infoblox_zone_delegated resource
• infoblox_zone_delegated data source
• terraform-infoblox-dns-view — upstream dns_view source
• terraform-infoblox-zone-auth — the parent authoritative zone a delegation must sit under
• terraform-infoblox-zone-forward — sibling zone type (conditional forwarding)

💙 "Infrastructure as Code should be standardized, consistent, and secure."