Replace the JSON credential saved in PD Google Cloud DNS when rotation is required. Creating a new service-account key in Google Cloud does not update the module’s saved provider automatically.

Identify the intended service account

Open Google Cloud DNS → Providers and review the connection name and project. Identify which service account the saved credential belongs to, and check whether other integrations use its existing keys.

The module reads the target project from project_id in the saved service-account JSON. Its provider form has a Service account JSON credential field, not a separate project-ID override. Use a provider credential prepared for the intended project; changing a connection label or customer binding does not select another project. Do not edit a downloaded key file to guess a different target.

A JSON key contains a private key and related identity fields. Keep it in the provider credential field and approved private storage, never a client note, public screenshot or support attachment. A project ID by itself is not an authentication credential.

Replace and verify

1. Open the intended service account under IAM & Admin → Service accounts in Google Cloud.
2. Use its Keys tab to create the permitted replacement JSON key.
3. Edit the corresponding provider in the module.
4. Choose Replace for Service account JSON and provide the complete new file contents.
5. Run Test connection, save and verify the intended zone/record reads.
6. Retire the old key only after the replacement is confirmed and its other uses are understood.

Where the original key still works, keep the overlap until the new connection is verified. Do not delete unrelated keys simply because they belong to the same service account. If organisation policy prevents creating a key, ask the project administrator to handle the approved replacement route.

Diagnose a failure precisely

A malformed or partial JSON file differs from a valid credential lacking DNS permissions. A service account with a role on another project differs from an API that is disabled in the intended project. Preserve the exact redacted result rather than repeatedly generating keys.

The connection test is a zone-list request, so separately review permission for a refused write. Rotation changes authentication; it should not require recreating zones or changing registrar nameservers. Use the connection guide if the replacement does not work.

See the PD Google Cloud DNS Blesta guide for related tasks, or explore the module.