Azure Network Rules Engine

azurerm_frontdoor_rules_engine (Terraform)

The Rules Engine in Network can be configured in Terraform with the resource name azurerm_frontdoor_rules_engine. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

An example could not be found in GitHub.

Parameters

The following arguments are supported:

• name - (Required) The name of the Rules engine configuration. Changing this forces a new resource to be created.

• frontdoor_name - (Required) The name of the Front Door instance. Changing this forces a new resource to be created.

• resource_group_name - (Required) The name of the resource group. Changing this forces a new resource to be created.

• rule - (Required) A rule block as defined below.

The rule block supports the following:

• name - (Required) The name of the rule.

• priority - (Required) Priority of the rule, must be unique per rules engine definition.

• action - (Required) A rule_action block as defined below.

• match_condition - One or more match_condition block as defined below.

The action block supports the following:

• request_header - A request_header block as defined below.

• response_header - A response_header block as defined below.

The request_header block supports the following:

• header_action_type can be set to Overwrite, Append or Delete.

• header_name header name (string).

• value value name (string).

The response_header block supports the following:

• header_action_type can be set to Overwrite, Append or Delete.

• header_name header name (string).

• value value name (string).

The match_condition block supports the following:

• variable can be set to IsMobile, RemoteAddr, RequestMethod, QueryString, PostArgs, RequestURI, RequestPath, RequestFilename, RequestFilenameExtension,RequestHeader,RequestBody or RequestScheme.

• selector match against a specific key when variable is set to PostArgs or RequestHeader. It cannot be used with QueryString and RequestMethod. Defaults to null.

• operator can be set to Any, IPMatch, GeoMatch, Equal, Contains, LessThan, GreaterThan, LessThanOrEqual, GreaterThanOrEqual, BeginsWith or EndsWith

• transform can be set to one or more values out of Lowercase, RemoveNulls, Trim, Uppercase, UrlDecode and UrlEncode

• negate_condition can be set to true or false to negate the given condition. Defaults to true.

• value (array) can contain one or more strings.

Explanation in Terraform Registry

Manages an Azure Front Door Rules Engine configuration and rules.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.