// Module included in the following assemblies:
//
// * osd_planning/gcp-ccs.adoc

:_mod-docs-content-type: PROCEDURE
[id="ocm-cli-create-managed-dns-zone_{context}"]
= Creating a managed DNS zone

[role="_abstract"]
Instead of granting {product-title} broad administrative control over your host projects, you can create your own managed DNS zones and provide {product-title} with strictly limited, scoped permissions before cluster creation. This allows you to maintain rigorous security compliance and adhere to the principle of least privilege, ensuring that {product-title} has exactly what it needs to run without risk to your other critical cloud workloads.

Use the {cluster-manager} CLI (`ocm`) to create a managed DNS zone associated with your account.

.Prerequisites

* You have downloaded version `v1.0.12` or later of the {cluster-manager} CLI (`ocm`) for your operating system from the link:https://console.redhat.com/openshift/downloads[Downloads] page on {cluster-manager}.
* You have the required permissions to create a DNS zone in your {GCP} account.
* You have identified the {GCP} project and network where your {product-title} cluster will be deployed, as you will need to associate the DNS zone with this information during creation.
* You have created a Workload Identity Federation (WIF) configuration to use WIF for cluster authentication. For more information, see _Creating a Workload Identity Federation configuration_.

.Procedure

* To create a managed DNS zone, run the following command:
+
[source,terminal]
----
$ ocm gcp create dns-zone --domain-prefix=<prefix> --project-id=<project_id> --network-id=<network_id> --network-project-id=<network_project_id>
----
+
where:

`--domain-prefix`:: Optional. Specifies a domain prefix for the DNS zone. If the {product-title} cluster name is longer than 15 characters, the domain prefix is used to ensure the generated domain name does not exceed DNS length limits.

`--project-id`:: Specifies the ID of the {GCP} project where the DNS zone will be created.

`--network-id`:: Specifies the network associated with the DNS zone. This is typically the network where your {product-title} cluster is deployed.
Note the DNS zone ID returned in the output. You will need this ID when creating your cluster.

`--network-project-id`:: Optional. Specifies the ID of the {GCP} project where the VPC network is located if it is different from the project where the DNS zone is being created. If not specified, it is assumed to be the same as the project where the DNS zone is being created.

.Verification

* To verify that the DNS zone was created successfully, run the following command:
+
[source,terminal]
----
$ ocm gcp list dns-zones
----



