Azure Network Custom HTTPS Configuration

azurerm_frontdoor_custom_https_configuration (Terraform)

The Custom HTTPS Configuration in Network can be configured in Terraform with the resource name azurerm_frontdoor_custom_https_configuration. The following sections describe 8 examples of how to use the resource and its parameters.

Example Usage from GitHub

ThaddeusJiang/devops_helpers

resource "azurerm_frontdoor_custom_https_configuration" "frontdoor1" {
  frontend_endpoint_id              = azurerm_frontdoor.app.frontend_endpoints["frontdoor1"]
  custom_https_provisioning_enabled = true

  custom_https_configuration {
    certificate_source                      = "AzureKeyVault"

DoesDotNet/propt-app

resource "azurerm_frontdoor_custom_https_configuration" "app" {
  frontend_endpoint_id              = azurerm_frontdoor.app.frontend_endpoint[1].id
  custom_https_provisioning_enabled = true

  custom_https_configuration {
    certificate_source = "FrontDoor"

aztfmod/terraform-azurerm-caf

resource "azurerm_frontdoor_custom_https_configuration" "fdchc" {
  frontend_endpoint_id = coalesce(
    try(var.settings.frontend_endpoint_id, null),
    try(var.remote_objects.frontdoor[var.settings.frontend_endpoint.lz_key][var.settings.frontend_endpoint.front_door_key].frontend_endpoints[var.settings.frontend_endpoint.name], null),
    try(var.remote_objects.frontdoor[var.client_config.landingzone_key][var.settings.frontend_endpoint.front_door_key].frontend_endpoints[var.settings.frontend_endpoint.name], null)
  )

kvega-95/PROJECT-TERRAFORM

resource "azurerm_frontdoor_custom_https_configuration" "fd_custom_https" {
  frontend_endpoint_id              = azurerm_frontdoor.fd-gaming.frontend_endpoint[0].id
  custom_https_provisioning_enabled = false

claranet/terraform-azurerm-front-door

resource "azurerm_frontdoor_custom_https_configuration" "custom_https_configuration" {
  for_each = { for fe in var.frontend_endpoints : fe.name => fe if try(fe["custom_https_configuration"], null) != null }

  frontend_endpoint_id = format("%s/frontendEndpoints/%s", azurerm_frontdoor.frontdoor.id, each.key)

  custom_https_provisioning_enabled = true

pkhuntia/aztfmod

resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
  for_each = {
    for key, value in var.settings.frontend_endpoints : key => value
    if try(value.custom_https_provisioning_enabled, false)
  }

aztfmod/terraform-azurerm-caf

resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
  for_each = {
    for key, value in var.settings.frontend_endpoints : key => value
    if try(value.custom_https_provisioning_enabled, false)
  }

mennaammar/spoke-landing-zone

resource "azurerm_frontdoor_custom_https_configuration" "frontdoor" {
  for_each = {
    for key, value in var.settings.frontend_endpoints : key => value
    if try(value.custom_https_provisioning_enabled, false)
  }

Parameters

• custom_https_provisioning_enabled required - bool
• frontend_endpoint_id required - string
• id optional computed - string
• resource_group_name optional - string
• custom_https_configuration list block
  • azure_key_vault_certificate_secret_name optional - string
  • azure_key_vault_certificate_secret_version optional - string
  • azure_key_vault_certificate_vault_id optional - string
  • certificate_source optional - string
  • minimum_tls_version optional computed - string
  • provisioning_state optional computed - string
  • provisioning_substate optional computed - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages the Custom Https Configuration for an Azure Front Door Frontend Endpoint.. -> NOTE: Defining custom https configurations using a separate azurerm_frontdoor_custom_https_configuration resource allows for parallel creation/update. !> BREAKING CHANGE: In order to address the ordering issue we have changed the design on how to retrieve existing sub resources such as frontend endpoints. Existing design will be deprecated and will result in an incorrect configuration. Please refer to the updated documentation below for more information. !> BREAKING CHANGE: The resource_group_name field has been removed as of the v2.58.0 provider release. If the resource_group_name field has been defined in your current azurerm_frontdoor_custom_https_configuration resource configuration file please remove it else you will receive a An argument named "resource_group_name" is not expected here. error. If your pre-existing Front Door instance contained inline custom_https_configuration blocks there are additional steps that will need to be completed to succefully migrate your Front Door onto the v2.58.0 provider which can be found in this guide. !> Be Aware: Azure is rolling out a breaking change on Friday 9th April which may cause issues with the CDN/FrontDoor resources. More information is available in this Github issue - however unfortunately this may necessitate a breaking change to the CDN and FrontDoor resources, more information will be posted in the Github issue as the necessary changes are identified.

resource "azurerm_resource_group" "example" {
  name     = "FrontDoorExampleResourceGroup"
  location = "West Europe"
}
data "azurerm_key_vault" "vault" {
  name                = "example-vault"
  resource_group_name = "example-vault-rg"
}
resource "azurerm_frontdoor" "example" {
  name                                         = "example-FrontDoor"
  resource_group_name                          = azurerm_resource_group.example.name
  enforce_backend_pools_certificate_name_check = false
  routing_rule {
    name               = "exampleRoutingRule1"
    accepted_protocols = ["Http", "Https"]
    patterns_to_match  = ["/*"]
    frontend_endpoints = ["exampleFrontendEndpoint1"]
    forwarding_configuration {
      forwarding_protocol = "MatchRequest"
      backend_pool_name   = "exampleBackendBing"
    }
  }
  backend_pool_load_balancing {
    name = "exampleLoadBalancingSettings1"
  }
  backend_pool_health_probe {
    name = "exampleHealthProbeSetting1"
  }
  backend_pool {
    name = "exampleBackendBing"
    backend {
      host_header = "www.bing.com"
      address     = "www.bing.com"
      http_port   = 80
      https_port  = 443
    }
    load_balancing_name = "exampleLoadBalancingSettings1"
    health_probe_name   = "exampleHealthProbeSetting1"
  }
  frontend_endpoint {
    name      = "exampleFrontendEndpoint1"
    host_name = "example-FrontDoor.azurefd.net"
  }
  frontend_endpoint {
    name      = "exampleFrontendEndpoint2"
    host_name = "examplefd1.examplefd.net"
  }
}
resource "azurerm_frontdoor_custom_https_configuration" "example_custom_https_0" {
  frontend_endpoint_id              = azurerm_frontdoor.example.frontend_endpoints["exampleFrontendEndpoint1"]
  custom_https_provisioning_enabled = false
}
resource "azurerm_frontdoor_custom_https_configuration" "example_custom_https_1" {
  frontend_endpoint_id              = azurerm_frontdoor.example.frontend_endpoints["exampleFrontendEndpoint2"]
  custom_https_provisioning_enabled = true
  custom_https_configuration {
    certificate_source                      = "AzureKeyVault"
    azure_key_vault_certificate_secret_name = "examplefd1"
    azure_key_vault_certificate_vault_id    = data.azurerm_key_vault.vault.id
  }
}

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.