Azure Network Frontdoor

azurerm_frontdoor (Terraform)

The Frontdoor in Network can be configured in Terraform with the resource name azurerm_frontdoor. The following sections describe 8 examples of how to use the resource and its parameters.

Example Usage from GitHub

mattykii/azureFrontDoorwithWebapps

resource "azurerm_frontdoor" "frontdoorkata" {
    name                                         = "frontdoorkata111"
    resource_group_name                          = data.azurerm_resource_group.kata1ResourceGroup.name
    enforce_backend_pools_certificate_name_check = true

    routing_rule {

andrewCluey/terraform-azurerm-frontdoor

resource "azurerm_frontdoor" "front_door" {
  name                                         = var.front_door_name
  resource_group_name                          = var.resource_group_name
  enforce_backend_pools_certificate_name_check = var.enforce_cert_check
  tags                                         = var.tags

josepht96/learning

resource "azurerm_frontdoor" "example" {
  name                                         = var.front_door_name
  resource_group_name                          = data.azurerm_resource_group.resource-group.name
  enforce_backend_pools_certificate_name_check = false

  routing_rule {

satyajitjem/Azurework

resource "azurerm_frontdoor" "example" {
  name                                         = "example-FrontDoor-CentralAPP"
  location                                     = "Global"
  resource_group_name                          = azurerm_resource_group.example.name
  enforce_backend_pools_certificate_name_check = false

johankardell/azure

resource "azurerm_frontdoor" "frontdoor" {
  name                                         = "fd-appgw-sample"
  location                                     = var.location
  resource_group_name                          = azurerm_resource_group.rg.name
  enforce_backend_pools_certificate_name_check = false

Checkmarx/kics

resource "azurerm_frontdoor" "positive" {
  name                                         = "example-FrontDoor"
  resource_group_name                          = azurerm_resource_group.example.name
  enforce_backend_pools_certificate_name_check = false

  routing_rule {

Checkmarx/kics

resource "azurerm_frontdoor" "negative" {
  name                                         = "example-FrontDoor"
  resource_group_name                          = azurerm_resource_group.example.name
  enforce_backend_pools_certificate_name_check = false

  routing_rule {

krlitux/front_door

resource "azurerm_frontdoor" "azfd" {
  name                                         = local.azfd_name
  resource_group_name                          = local.rsgr_name
  enforce_backend_pools_certificate_name_check = false

  routing_rule {

Parameters

• backend_pool_health_probes optional computed - map from string to string
• backend_pool_load_balancing_settings optional computed - map from string to string
• backend_pools optional computed - map from string to string
• backend_pools_send_receive_timeout_seconds optional - number
• cname optional computed - string
• enforce_backend_pools_certificate_name_check required - bool
• friendly_name optional - string
• frontend_endpoints optional computed - map from string to string
• header_frontdoor_id optional computed - string
• id optional computed - string
• load_balancer_enabled optional - bool
• location optional computed - string
• name required - string
• resource_group_name required - string
• routing_rules optional computed - map from string to string
• tags optional - map from string to string
• backend_pool list block
  • health_probe_name required - string
  • id optional computed - string
  • load_balancing_name required - string
  • name required - string
  • backend list block
    • address required - string
    • enabled optional - bool
    • host_header required - string
    • http_port required - number
    • https_port required - number
    • priority optional - number
    • weight optional - number
• backend_pool_health_probe list block
  • enabled optional - bool
  • id optional computed - string
  • interval_in_seconds optional - number
  • name required - string
  • path optional - string
  • probe_method optional - string
  • protocol optional - string
• backend_pool_load_balancing list block
  • additional_latency_milliseconds optional - number
  • id optional computed - string
  • name required - string
  • sample_size optional - number
  • successful_samples_required optional - number
• frontend_endpoint list block
  • custom_https_provisioning_enabled optional computed - bool
  • host_name required - string
  • id optional computed - string
  • name required - string
  • session_affinity_enabled optional - bool
  • session_affinity_ttl_seconds optional - number
  • web_application_firewall_policy_link_id optional - string
  • custom_https_configuration list block
    • azure_key_vault_certificate_secret_name optional - string
    • azure_key_vault_certificate_secret_version optional - string
    • azure_key_vault_certificate_vault_id optional - string
    • certificate_source optional - string
    • minimum_tls_version optional computed - string
    • provisioning_state optional computed - string
    • provisioning_substate optional computed - string
• routing_rule list block
  • accepted_protocols required - list of string
  • enabled optional - bool
  • frontend_endpoints required - list of string
  • id optional computed - string
  • name required - string
  • patterns_to_match required - list of string
  • forwarding_configuration list block
    • backend_pool_name required - string
    • cache_enabled optional - bool
    • cache_query_parameter_strip_directive optional - string
    • cache_use_dynamic_compression optional - bool
    • custom_forwarding_path optional - string
    • forwarding_protocol optional - string
  • redirect_configuration list block
    • custom_fragment optional - string
    • custom_host optional - string
    • custom_path optional - string
    • custom_query_string optional - string
    • redirect_protocol required - string
    • redirect_type required - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages an Azure Front Door instance. Azure Front Door Service is Microsoft's highly available and scalable web application acceleration platform and global HTTP(s) load balancer. It provides built-in DDoS protection and application layer security and caching. Front Door enables you to build applications that maximize and automate high-availability and performance for your end-users. Use Front Door with Azure services including Web/Mobile Apps, Cloud Services and Virtual Machines – or combine it with on-premises services for hybrid deployments and smooth cloud migration. Below are some of the key scenarios that Azure Front Door Service addresses:

• Use Front Door to improve application scale and availability with instant multi-region failover
• Use Front Door to improve application performance with SSL offload and routing requests to the fastest available application backend.
• Use Front Door for application layer security and DDoS protection for your application. !>Be Aware: Azure is rolling out a breaking change on Friday 9th April which may cause issues with the CDN/FrontDoor resources. More information is available in this Github issue - however unfortunately this may necessitate a breaking change to the CDN and FrontDoor resources, more information will be posted in the Github issue as the necessary changes are identified. !>BREAKING CHANGE: The custom_https_provisioning_enabled field and the custom_https_configuration block have been removed from the azurerm_frontdoor resource in the v2.58.0 provider due to changes made by the service team. If you wish to enable the custom https configuration functionality within your azurerm_frontdoor resource moving forward you will need to define a separate azurerm_frontdoor_custom_https_configuration block in your configuration file. !>BREAKING CHANGE: With the release of the v2.58.0 provider, if you run the apply command against an existing Front Door resource it will not apply the detected changes. Instead it will persist the explicit_resource_order mapping structure to the state file. Once this operation has completed the resource will resume functioning normally.This change in behavior in Terraform is due to an issue where the underlying service teams API is now returning the response JSON out of order from the way it was sent to the resource via Terraform causing unexpected discrepancies in the plan after the resource has been provisioned. If your pre-existing Front Door instance contains custom_https_configuration blocks there are additional steps that will need to be completed to successfully migrate your Front Door onto the v2.58.0 provider which can be found in this guide.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.