Azure App Service (Web Apps) Managed Certificate

azurerm_app_service_managed_certificate (Terraform)

The Managed Certificate in App Service (Web Apps) can be configured in Terraform with the resource name azurerm_app_service_managed_certificate. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

kashw2/Fleet-of-the-Faithful-Knights

resource "azurerm_app_service_managed_certificate" "panel_certificate" {
  custom_hostname_binding_id = var.panel_binding_id
}

resource "azurerm_app_service_managed_certificate" "api_certificate" {
  custom_hostname_binding_id = var.api_binding_id

VentsislavDinev/en_sample

resource "azurerm_app_service_managed_certificate" "example" {
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.example.id

zoni/terraform-azfunc

resource "azurerm_app_service_managed_certificate" "function_custom_domain_certificate" {
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.function_custom_domain_binding.id
}

resource "azurerm_app_service_certificate_binding" "function_custom_domain_certificate_binding" {
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.function_custom_domain_binding.id

imjoseangel/sandbox

resource "azurerm_app_service_managed_certificate" "main" {
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.main.id
}

resource "azurerm_app_service_certificate_binding" "main" {
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.main.id

ccrepin/azure-tf-private-function

resource "azurerm_app_service_managed_certificate" "function_managed_certificat" {
  custom_hostname_binding_id = azurerm_app_service_custom_hostname_binding.function_custom_domain.id
}

resource "azurerm_app_service_certificate_binding" "function_custom_certificat_bind" {
  hostname_binding_id = azurerm_app_service_custom_hostname_binding.function_custom_domain.id

Parameters

• canonical_name optional computed - string
• custom_hostname_binding_id required - string
• expiration_date optional computed - string
• friendly_name optional computed - string
• host_names optional computed - list of string
• id optional computed - string
• issue_date optional computed - string
• issuer optional computed - string
• subject_name optional computed - string
• tags optional - map from string to string
• thumbprint optional computed - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

This certificate can be used to secure custom domains on App Services (Windows and Linux) hosted on an App Service Plan of Basic and above (free and shared tiers are not supported).

NOTE: A certificate is valid for six months, and about a month before the certificate’s expiration date, App Services renews/rotates the certificate. This is managed by Azure and doesn't requre this resource to be changed or reprovisioned. It will change the thumbprint computed attribute the next time the resource is refreshed after rotation occurs, so keep that in mind if you have any dependencies on this attribute directly.

Tips: Best Practices for The Other Azure App Service (Web Apps) Resources

In addition to the azurerm_app_service, Azure App Service (Web Apps) has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_app_service

Ensure your App Service is accessible via HTTPS only

It is better to configure the App Service to be accessible via HTTPS only. By default, both HTTP and HTTPS are available.

azurerm_function_app

Ensure to enable authentication to prevent anonymous request being accepted

It is better to enable authentication to prevent anonymous requests and ensure all communications in the application are authenticated.