Skip to content

Commit 0fcc0e4

Browse files
v-regandownerv-regandowner
authored
Merge pull request #296792 from LiSeda/LS-tfwaf
LS_Terraform quickstart WAF v2
2 parents 80b44f8 + 8a3bb07 commit 0fcc0e4

File tree

2 files changed

+166
-0
lines changed

2 files changed

+166
-0
lines changed

‎articles/web-application-firewall/quickstart-web-application-firewall-terraform.md

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
---
2+
title: 'Quickstart: Use Terraform to configure Azure Web Application Firewall v2 on Azure Application Gateway'
3+
description: In this quickstart, you use Terraform to create an Azure Application Gateway with an Azure Web Application Firewall (WAF) v2 policy. A virtual network with a subnet, a static public IP address, a WAF policy with custom rules, and Azure Application Gateway with autoscaling work together to block specific IP addresses.
4+
ms.topic: quickstart
5+
ms.date: 04/08/2025
6+
ms.custom: devx-track-terraform
7+
ms.service: azure-web-application-firewall
8+
author: halkazwini
9+
ms.author: halkazwini
10+
#customer intent: As a Terraform user, I want to learn how to configure Azure Web Application Firewall v2 on Azure Application Gateway.
11+
content_well_notification:
12+
- AI-contribution
13+
---
14+
15+
# Quickstart: Use Terraform to configure Azure Web Application Firewall v2 on Azure Application Gateway
16+
17+
In this quickstart, you use Terraform to create an Azure Application Gateway with an Azure Web Application Firewall (WAF) v2 policy. A key component of creating scalable, reliable, and secure web front ends in Azure, Application Gateway is a web traffic load balancer that helps you to manage traffic to your web applications. Application Gateway bases how it routes traffic on factors that include round-robin, cookie-based sessions, and more. In addition to an Application Gateway, this code also creates a resource group, virtual network, subnet within the virtual network, public IP address, and a WAF policy with custom rules to block traffic from a specific IP address.
18+
19+
[!INCLUDE [About Terraform](~/azure-dev-docs-pr/articles/terraform/includes/abstract.md)]
20+
21+
> [!div class="checklist"]
22+
> * Define the IP address that the WAF custom rule should block.
23+
> * Create an Azure resource group with a unique name.
24+
> * Establish a virtual network with a specific name and address.
25+
> * Generate a random name for the subnet, and create a subnet in the virtual network.
26+
> * Generate a public IP address.
27+
> * Create a WAF policy.
28+
> * Configure settings and define managed rules for the WAF policy.
29+
> * Create a custom rule to block traffic from a specific IP address.
30+
> * Set up the Application Gateway.
31+
> * Configure the SKU and capacity of the Application Gateway.
32+
> * Enable autoscaling for the Application Gateway.
33+
> * Configure the gateway's IP settings.
34+
> * Set up the front-end IP configuration, and define the front-end port.
35+
> * Define the back-end address pool with IP addresses, and configure back-end HTTP settings.
36+
> * Define the HTTP listener.
37+
> * Define the request routing rule.
38+
> * Associate the WAF policy with the Application Gateway.
39+
> * Output the resource group name, public IP address, Application Gateway ID, WAF policy ID, and Application Gateway.
40+
41+
## Prerequisites
42+
43+
- An Azure account with an active subscription. You can [create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
44+
45+
- Terraform. For more information, see [Install and configure Terraform](/azure/developer/terraform/quickstart-configure).
46+
47+
## Implement the Terraform code
48+
49+
The sample code for this article is located in the [Azure Terraform GitHub repo](https://github.com/Azure/terraform/tree/master/quickstart/101-web-application-firewall). You can view the log file containing the [test results from current and previous versions of Terraform](https://github.com/Azure/terraform/tree/master/quickstart/101-web-application-firewall/TestRecord.md). See more [articles and sample code showing how to use Terraform to manage Azure resources](/azure/terraform).
50+
51+
1. Create a directory in which to test and run the sample Terraform code, and make it the current directory.
52+
53+
1. Create a file named `main.tf`, and insert the following code:
54+
:::code language="Terraform" source="~/terraform_samples/quickstart/101-web-application-firewall/main.tf":::
55+
56+
1. Create a file named `outputs.tf`, and insert the following code:
57+
:::code language="Terraform" source="~/terraform_samples/quickstart/101-web-application-firewall/outputs.tf":::
58+
59+
1. Create a file named `providers.tf`, and insert the following code:
60+
:::code language="Terraform" source="~/terraform_samples/quickstart/101-web-application-firewall/providers.tf":::
61+
62+
1. Create a file named `variables.tf`, and insert the following code:
63+
:::code language="Terraform" source="~/terraform_samples/quickstart/101-web-application-firewall/variables.tf":::
64+
65+
> [!IMPORTANT]
66+
> If you're using the 4.x azurerm provider, you must [explicitly specify the Azure subscription ID](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/4.0-upgrade-guide#specifying-subscription-id-is-now-mandatory) to authenticate to Azure before running the Terraform commands.
67+
>
68+
> One way to specify the Azure subscription ID without putting it in the `providers` block is to specify the subscription ID in an environment variable named `ARM_SUBSCRIPTION_ID`.
69+
>
70+
> For more information, see the [Azure provider reference documentation](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs#argument-reference).
71+
72+
## Initialize Terraform
73+
74+
[!INCLUDE [terraform-init.md](~/azure-dev-docs-pr/articles/terraform/includes/terraform-init.md)]
75+
76+
## Create a Terraform execution plan
77+
78+
[!INCLUDE [terraform-plan.md](~/azure-dev-docs-pr/articles/terraform/includes/terraform-plan.md)]
79+
80+
## Apply a Terraform execution plan
81+
82+
[!INCLUDE [terraform-apply-plan.md](~/azure-dev-docs-pr/articles/terraform/includes/terraform-apply-plan.md)]
83+
84+
## Verify the results
85+
86+
### [Azure CLI](#tab/azure-cli)
87+
88+
1. Get the Azure resource group name.
89+
90+
```console
91+
resource_group_name=$(terraform output -raw resource_group_name)
92+
```
93+
94+
1. Get the public IP address.
95+
96+
```console
97+
public_ip_address=$(terraform output -raw public_ip_address)
98+
```
99+
100+
1. Get the WAF policy ID.
101+
102+
```console
103+
web_application_firewall_policy_id=$(terraform output -raw web_application_firewall_policy_id)
104+
```
105+
106+
1. Get the Application Gateway ID.
107+
108+
```console
109+
application_gateway_id=$(terraform output -raw application_gateway_id)
110+
```
111+
112+
1. Run `az network application-gateway show` to view the Application Gateway.
113+
114+
```azurecli
115+
az appservice ase show --name $application_gateway_name --resource-group $resource_group_name
116+
```
117+
118+
### [Azure PowerShell](#tab/azure-powershell)
119+
120+
1. Get the Azure resource group name.
121+
122+
```console
123+
$resource_group_name=$(terraform output -raw resource_group_name)
124+
```
125+
126+
1. Get the public IP address.
127+
128+
```console
129+
$public_ip_address=$(terraform output -public_ip_address)
130+
```
131+
132+
1. Get the WAF policy ID.
133+
134+
```console
135+
$web_application_firewall_policy_id=$(terraform output -web_application_firewall_policy_id)
136+
```
137+
138+
1. Get the Application Gateway ID.
139+
140+
```console
141+
$application_gateway_id=$(terraform output -application_gateway_id)
142+
```
143+
144+
1. Run `Get-AzAppServiceEnvironment` to view the Application Gateway.
145+
146+
```azurepowershell
147+
Get-AzApplicationGateway -Name $application_gateway_name -ResourceGroupName $resource_group_name
148+
```
149+
150+
---
151+
152+
## Clean up resources
153+
154+
[!INCLUDE [terraform-plan-destroy.md](~/azure-dev-docs-pr/articles/terraform/includes/terraform-plan-destroy.md)]
155+
156+
## Troubleshoot Terraform on Azure
157+
158+
[Troubleshoot common problems when using Terraform on Azure](/azure/developer/terraform/troubleshoot).
159+
160+
## Related content
161+
162+
- [Create Web Application Firewall policies for Application Gateway](/azure/web-application-firewall/ag/create-waf-policy-ag)
163+
- [Associate a WAF policy with an existing Application Gateway](/azure/web-application-firewall/ag/associate-waf-policy-existing-gateway)
164+
- [Customize Web Application Firewall rules](/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-portal)

‎articles/web-application-firewall/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ items:
3838
href: ./ag/quick-create-template.md
3939
- name: Create Web Application Firewall v2 - Bicep
4040
href: ./ag/quick-create-bicep.md
41+
- name: Create Web Application Firewall v2 – Terraform
42+
href: quickstart-web-application-firewall-terraform.md
4143
- name: Front Door
4244
items:
4345
- name: Create WAF policy - portal

0 commit comments

Comments
 (0)