Moving a DNS zone to a different folder

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

1. Configure access permissions for the target folder. The account from the source folder you are going to use to perform the operation must have at least the dns.editor role for the target folder.

2. Get the target folder ID.

3. In the configuration file, update the folder_id parameter in the yandex_dns_zone resource:

   resource "yandex_dns_zone" "zone1" {
       name        = "<zone_name>"
       description = "<zone_description>"
       zone        = "<domain_zone>."
       public      = true
       folder_id   = "<target_folder_ID>"
   }
   

   Where:

   • name: Zone name. Note that the zone name must be unique within a folder.
   • description: Zone description.
   • zone: Domain zone name. Note that the zone name must end with a trailing dot. You cannot create top-level domain (TLD) zones. To create a domain name with non-Latin characters, use Punycode encoding.
   • public: Zone visibility, public or private.
   • folder_id: ID of the folder to place the DNS zone in (by default, specified from the environment variable).

   For more information about yandex_dns_zone properties, see this provider guide.

4. Apply the new configuration:

   1. In the terminal, go to the directory where you edited the configuration file.

   2. Make sure the configuration file is correct using this command:

      terraform validate
      

      If the configuration is correct, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

   4. Apply the changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   Terraform will move the DNS zone to the specified destination folder without re-creating it. You can check the update using the management console.

Use the move REST API method for the DnsZone resource or the DnsZoneService/Move gRPC API call.

REST API exampleREST API example

Below is an example of a Bash script for Linux.

To use it, get authenticated with the API and install cURL.

1. Create a script file:

   sudo touch <file_name>
   

2. Open the file to write the script to:

   sudo nano <file_name>
   

3. Place the script in the file:

   #!/bin/bash
   
   # Creating variables
   
   export IAM_TOKEN=`yc iam create-token`
   
   dnsZoneId='<DNS_zone_ID>'
   destinationFolderId='<folder_ID>'
   
   # Moving a DNS zone
   
   curl \
     --request POST \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --header "Content-Type: application/json" \
     --data '{ "destinationFolderId": "'"${destinationFolderId}"'" }' \
     "https://dns.api.cloud.yandex.net/dns/v1/zones/${dnsZoneId}:move"
   

   Where:

   • IAM_TOKEN: IAM token for API authentication.
   • dnsZoneId: ID of the DNS zone to move.
   • destinationFolderId: ID of the folder to move the DNS zone to.

4. Make the file executable:

   chmod +x <file_name>
   

5. Run the script:

   ./<file_name>
   

gRPC API examplegRPC API example

Below is an example Bash script for calling the gRPC API using grpcurl.

1. Install grpcurl:

   • Using Bash:

     curl -L https://github.com/fullstorydev/grpcurl/releases/download/v1.9.3/grpcurl_1.9.3_linux_x86_64.tar.gz | tar -xz
     sudo mv grpcurl /usr/local/bin/
     

   • Using Golang:

     go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest
     

2. Create a script file:

   sudo touch <file_name>
   

3. Open the file to write the script to:

   nano <file_name>
   

4. Place the script in the file:

   #!/bin/bash
   
   # Creating variables
   
   export IAM_TOKEN=$(yc iam create-token)
   
   dnsZoneId='<DNS_zone_ID>'
   destinationFolderId='<folder_ID>'
   
   # Moving a DNS zone
   
   grpcurl \
   -d "{
       \"dns_zone_id\": \"${dnsZoneId}\",
       \"destination_folder_id\": \"${destinationFolderId}\"
   }" \
   -H "authorization: Bearer ${IAM_TOKEN}" \
   -H "x-client-request-id: $(uuidgen)" \
   dns.api.cloud.yandex.net:443 \
   yandex.cloud.dns.v1.DnsZoneService/Move
   

   Where:

   • IAM_TOKEN: IAM token for API authentication.
   • dnsZoneId: ID of the DNS zone to move.
   • destinationFolderId: ID of the folder to move the DNS zone to.
   • x-client-request-id: Unique request ID for tracing.

5. Make the file executable:

   chmod +x <file_name>
   

6. Run the script:

   ./<file_name>
   

This will return an operation in JSON format:

{
    "id": "dns-zone-move-123456789",
    "description": "Update DNS Zone",
    "createdAt": "2026-02-19T09:52:35.239149422Z",
    "createdBy": "aje6f5h1h2h3********",
    "modifiedAt": "2026-02-19T09:52:35.239218092Z",
    "done": true,
    "metadata": {
        "@type": "type.googleapis.com/yandex.cloud.dns.v1.MoveDnsZoneMetadata",
        "dnsZoneId": "aet29qhara5j********"
    },
    "response": {
        "@type": "type.googleapis.com/yandex.cloud.dns.v1.DnsZone",
        "createdAt": "2026-02-19T07:09:53.853Z",
        "folderId": "b1g66mft1vop********",
        "id": "aet29qhara5j********",
        "name": "my-public-zone",
        "publicVisibility": {},
        "zone": "example.com."
    }
}

Where:

• id: Unique operation ID.
• metadata.dnsZoneId: ID of the DNS zone to move.
• response: Updated DNS zone after migration.
• done: Operation completion status.

For a detailed method description, see the gRPC API reference.