1. Open the GCP Console and select the project where you want to enable DNS logging.
2. In the left-hand navigation menu, click on “Network services” and then click on “Cloud DNS”.
3. Click on the checkbox next to the DNS zone for which you want to enable logging.
4. Click on the “Edit” button at the top of the page.
5. Scroll down to the “Logging” section and click on the “Enable” button.
6. Select the “Logs” tab and choose the logs you want to enable.
7. Click on the “Save” button to save your changes.
8. Repeat steps 3-7 for each DNS zone in your project.

​

1. Open the Google Cloud Console and select the project where the VPC networks are located.
2. Open the Cloud Shell by clicking on the icon on the top right corner of the console.
3. Run the following command to enable Cloud DNS logging for all VPC networks in the project: gcloud dns managed-zones list | awk '{print "gcloud dns managed-zones update "$1" --log-dns-queries";}' | grep -v "LOGGING" | bash This command will list all the managed zones in the project, and then update each managed zone with the --log-dns-queries flag to enable Cloud DNS logging.
4. Verify that Cloud DNS logging has been enabled for all VPC networks by running the following command: gcloud dns managed-zones describe [MANAGED_ZONE_NAME] Replace [MANAGED_ZONE_NAME] with the name of the managed zone you want to verify. Look for the dnsQueriesLogMode field in the output, which should be set to ALL.

1. Import the necessary libraries and authenticate with GCP:

from google.cloud import dns
from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('/path/to/credentials.json')
client = dns.Client(project='your-project-id', credentials=credentials)

2. Get a list of all VPC networks in the project:

networks = client.list_networks()

3. For each VPC network, check if logging is enabled for Cloud DNS:

for network in networks:
    dns_settings = network.dns_settings
    if dns_settings:
        if not dns_settings.logging_enabled:
            dns_settings.logging_enabled = True
            network.update()

4. Save the script and run it to enable Cloud DNS logging for all VPC networks in the project.

# VPC network (existing or managed elsewhere)
resource "google_compute_network" "VPC_NETWORK" {
  name                    = "VPC_NETWORK_NAME" # replace with your VPC network name
  auto_create_subnetworks = false
}

# Cloud DNS policy to enable DNS query logging for this VPC network
resource "google_dns_policy" "vpc_dns_logging" {
  name           = "VPC_NETWORK_NAME-dns-logging-policy" # replace consistently with your VPC network name
  enable_logging = true

  networks {
    network_url = google_compute_network.VPC_NETWORK.self_link
  }
}

• VPC_NETWORK_NAME with your actual VPC network name.
• If the VPC is not managed in this Terraform config, replace google_compute_network.VPC_NETWORK.self_link with the full self-link of the existing network.