Azure Network Custom HTTPS Configuration
This page shows how to write Terraform and Azure Resource Manager for Network Custom HTTPS Configuration and write them securely.
azurerm_frontdoor_custom_https_configuration (Terraform)
The Custom HTTPS Configuration in Network can be configured in Terraform with the resource name azurerm_frontdoor_custom_https_configuration
. The following sections describe 8 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_frontdoor_custom_https_configuration" "frontdoor1" {
frontend_endpoint_id = azurerm_frontdoor.app.frontend_endpoints["frontdoor1"]
custom_https_provisioning_enabled = true
custom_https_configuration {
certificate_source = "AzureKeyVault"
resource "azurerm_frontdoor_custom_https_configuration" "app" {
frontend_endpoint_id = azurerm_frontdoor.app.frontend_endpoint[1].id
custom_https_provisioning_enabled = true
custom_https_configuration {
certificate_source = "FrontDoor"
resource "azurerm_frontdoor_custom_https_configuration" "fdchc" {
frontend_endpoint_id = coalesce(
try(var.settings.frontend_endpoint_id, null),
try(var.remote_objects.frontdoor[var.settings.frontend_endpoint.lz_key][var.settings.frontend_endpoint.front_door_key].frontend_endpoints[var.settings.frontend_endpoint.name], null),
try(var.remote_objects.frontdoor[var.client_config.landingzone_key][var.settings.frontend_endpoint.front_door_key].frontend_endpoints[var.settings.frontend_endpoint.name], null)
)
resource "azurerm_frontdoor_custom_https_configuration" "fd_custom_https" {
frontend_endpoint_id = azurerm_frontdoor.fd-gaming.frontend_endpoint[0].id
custom_https_provisioning_enabled = false
resource "azurerm_frontdoor_custom_https_configuration" "custom_https_configuration" {
for_each = { for fe in var.frontend_endpoints : fe.name => fe if try(fe["custom_https_configuration"], null) != null }
frontend_endpoint_id = format("%s/frontendEndpoints/%s", azurerm_frontdoor.frontdoor.id, each.key)
custom_https_provisioning_enabled = true
resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
for_each = {
for key, value in var.settings.frontend_endpoints : key => value
if try(value.custom_https_provisioning_enabled, false)
}
resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
for_each = {
for key, value in var.settings.frontend_endpoints : key => value
if try(value.custom_https_provisioning_enabled, false)
}
resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
for_each = {
for key, value in var.settings.frontend_endpoints : key => value
if try(value.custom_https_provisioning_enabled, false)
}
Parameters
-
custom_https_provisioning_enabled
required - bool -
frontend_endpoint_id
required - string -
id
optional computed - string -
resource_group_name
optional - string -
custom_https_configuration
list block-
azure_key_vault_certificate_secret_name
optional - string -
azure_key_vault_certificate_secret_version
optional - string -
azure_key_vault_certificate_vault_id
optional - string -
certificate_source
optional - string -
minimum_tls_version
optional computed - string -
provisioning_state
optional computed - string -
provisioning_substate
optional computed - string
-
-
timeouts
single block
Explanation in Terraform Registry
Manages the Custom Https Configuration for an Azure Front Door Frontend Endpoint.. -> NOTE: Defining custom https configurations using a separate
azurerm_frontdoor_custom_https_configuration
resource allows for parallel creation/update. !> BREAKING CHANGE: In order to address the ordering issue we have changed the design on how to retrieve existing sub resources such as frontend endpoints. Existing design will be deprecated and will result in an incorrect configuration. Please refer to the updated documentation below for more information. !> BREAKING CHANGE: Theresource_group_name
field has been removed as of thev2.58.0
provider release. If theresource_group_name
field has been defined in your currentazurerm_frontdoor_custom_https_configuration
resource configuration file please remove it else you will receive aAn argument named "resource_group_name" is not expected here.
error. If your pre-existing Front Door instance contained inlinecustom_https_configuration
blocks there are additional steps that will need to be completed to succefully migrate your Front Door onto thev2.58.0
provider which can be found in this guide. !> Be Aware: Azure is rolling out a breaking change on Friday 9th April which may cause issues with the CDN/FrontDoor resources. More information is available in this Github issue - however unfortunately this may necessitate a breaking change to the CDN and FrontDoor resources, more information will be posted in the Github issue as the necessary changes are identified.resource "azurerm_resource_group" "example" { name = "FrontDoorExampleResourceGroup" location = "West Europe" } data "azurerm_key_vault" "vault" { name = "example-vault" resource_group_name = "example-vault-rg" } resource "azurerm_frontdoor" "example" { name = "example-FrontDoor" resource_group_name = azurerm_resource_group.example.name enforce_backend_pools_certificate_name_check = false routing_rule { name = "exampleRoutingRule1" accepted_protocols = ["Http", "Https"] patterns_to_match = ["/*"] frontend_endpoints = ["exampleFrontendEndpoint1"] forwarding_configuration { forwarding_protocol = "MatchRequest" backend_pool_name = "exampleBackendBing" } } backend_pool_load_balancing { name = "exampleLoadBalancingSettings1" } backend_pool_health_probe { name = "exampleHealthProbeSetting1" } backend_pool { name = "exampleBackendBing" backend { host_header = "www.bing.com" address = "www.bing.com" http_port = 80 https_port = 443 } load_balancing_name = "exampleLoadBalancingSettings1" health_probe_name = "exampleHealthProbeSetting1" } frontend_endpoint { name = "exampleFrontendEndpoint1" host_name = "example-FrontDoor.azurefd.net" } frontend_endpoint { name = "exampleFrontendEndpoint2" host_name = "examplefd1.examplefd.net" } } resource "azurerm_frontdoor_custom_https_configuration" "example_custom_https_0" { frontend_endpoint_id = azurerm_frontdoor.example.frontend_endpoints["exampleFrontendEndpoint1"] custom_https_provisioning_enabled = false } resource "azurerm_frontdoor_custom_https_configuration" "example_custom_https_1" { frontend_endpoint_id = azurerm_frontdoor.example.frontend_endpoints["exampleFrontendEndpoint2"] custom_https_provisioning_enabled = true custom_https_configuration { certificate_source = "AzureKeyVault" azure_key_vault_certificate_secret_name = "examplefd1" azure_key_vault_certificate_vault_id = data.azurerm_key_vault.vault.id } }
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/frontDoors (Azure Resource Manager)
The frontDoors in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/frontDoors
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"frontdoorName": {
[
{
"ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg-test/providers/Microsoft.Network/frontdoors/frontdoor-A",
"Id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg-test/providers/Microsoft.Network/frontdoors/frontdoor-A",
"Identity": null,
"type": "Microsoft.Network/frontDoors",
"name": "[variables('frontDoorName')]",
"location": "[resourceGroup().location]",
"properties": {
"routingRules": [
{
"type": "Microsoft.Network/frontDoors",
"name": "[variables('frontDoorName')]",
"location": "[resourceGroup().location]",
"properties": {
"routingRules": [
{
"type": "Microsoft.Network/frontDoors",
"name": "[variables('frontDoorName')]",
"location": "[resourceGroup().location]",
"properties": {
"routingRules": [
{
"type": "Microsoft.Network/frontDoors",
"name": "[variables('frontDoorName')]",
"location": "[resourceGroup().location]",
"properties": {
"routingRules": [
{
"type": "Microsoft.Network/frontDoors",
"name": "[parameters('frontDoorName')]",
"location": "[variables('frontdoorLocation')]",
"properties": {
"routingRules": [
{
"type": "Microsoft.Network/frontDoors",
"apiVersion": "2020-01-01",
"name": "[parameters('frontDoorName')]",
"location": "global",
"properties": {
"enabledState": "Enabled",
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workflows_trafficcontrol_name": {
"type": "Microsoft.Network/frontDoors",
"name": "[variables('frontDoorName')]",
"location": "[variables('frontdoorLocation')]",
"tags": {},
"properties": {
"routingRules": [
Frequently asked questions
What is Azure Network Custom HTTPS Configuration?
Azure Network Custom HTTPS Configuration is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Custom HTTPS Configuration?
For Terraform, the ThaddeusJiang/devops_helpers, DoesDotNet/propt-app and aztfmod/terraform-azurerm-caf source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the Theatreers/Theatreers, Azure/PSRule.Rules.Azure and Azure/azure-resource-manager-schemas source code examples are useful. See the Azure Resource Manager Example section for further details.