diff --git a/README.md b/README.md index bc0c3bf..c148059 100644 --- a/README.md +++ b/README.md @@ -243,55 +243,75 @@ Tag names are case-insensitive for operations. A tag with a tag name, regardless An effective naming convention assembles resource names by using important resource information as parts of a resource's name. For example, using these [recommended naming conventions](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging#example-names), a public IP resource for a production SharePoint workload is named like this: `pip-sharepoint-prod-westus-001`. + ## Requirements | Name | Version | |------|---------| -| terraform | >= 0.13 | -| azurerm | >= 2.59.0 | +| [terraform](#requirement\_terraform) | >= 0.13 | +| [azurerm](#requirement\_azurerm) | >= 3.0.0 | ## Providers | Name | Version | |------|---------| -| azurerm | >= 2.59.0 | +| [azurerm](#provider\_azurerm) | >= 3.0.0 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [azurerm_frontdoor.main](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/frontdoor) | resource | +| [azurerm_frontdoor_custom_https_configuration.main](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/frontdoor_custom_https_configuration) | resource | +| [azurerm_frontdoor_firewall_policy.main](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/frontdoor_firewall_policy) | resource | +| [azurerm_monitor_diagnostic_setting.fd-diag](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) | resource | +| [azurerm_resource_group.rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource | +| [azurerm_log_analytics_workspace.logws](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/log_analytics_workspace) | data source | +| [azurerm_resource_group.rgrp](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source | +| [azurerm_storage_account.storeacc](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/storage_account) | data source | ## Inputs -Name | Description | Type | Default ----- | ----------- | ---- | ------- -`create_resource_group`|Create new resource group and use it for all networking resources|string|`""` -`resource_group_name`|The name of an existing resource group.|string|`""` -`location`|The location for all resources while creating a new resource group.|string|`""` -`frontdoor_name`|Specifies the name of the Front Door service. Must be globally unique|string|`""` -`friendly_name`|A friendly name for the Front Door service|string|`""` -`backend_pools_send_receive_timeout_seconds`|Specifies the send and receive timeout on forwarding request to the backend. When the timeout is reached, the request fails and returns. Possible values are between `0` - `240`. Defaults to `60`.|number|`60` -`enforce_backend_pools_certificate_name_check`|Enforce certificate name check on HTTPS requests to all backend pools, this setting will have no effect on HTTP requests. Permitted values are `true` or `false`.|string|`false` -`backend_pools`|A logical grouping of app instances across the world that receive the same traffic and respond with expected behavior. These backends are deployed across different regions or within the same region. All backends can be in `Active/Active` deployment mode or what is defined as `Active/Passive` configuration. Azure by default allows specifying up to `50` Backend Pools.|list(object({}))|`[]` -`backend_pool_health_probes`|The list of backend pool health probes.|list(object({}))|`[]` -`backend_pool_load_balancing`|Load-balancing settings for the backend pool to determine if the backend is healthy or unhealthy. They also check how to load-balance traffic between different backends in the backend pool.|list(object({}))|`[]` -`frontend_endpoints`|Lists all of the frontend endpoints within a Front Door|list(object({}))|`[]` -`routing_rules`|The list of Routing Rules to determine which particular rule to match the request to and then take the defined action in the configuration|list(object({}))|`[]` -`web_application_firewall_policy`|Manages an Azure Front Door Web Application Firewall Policy instance|map(object({}))|`null` -`log_analytics_workspace_name`|The name of log analytics workspace name|string|`null` -`storage_account_name`|The name of the hub storage account to store logs|string|`null` -`Tags`|A map of tags to add to all resources|map|`{}` +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [backend\_pool\_health\_probes](#input\_backend\_pool\_health\_probes) | The list of backend pool health probes. | 
list(object({
    name                = string
    path                = optional(string)
    protocol            = optional(string)
    probe_method        = optional(string)
    interval_in_seconds = optional(number)
  }))
| `[]` | no | +| [backend\_pool\_load\_balancing](#input\_backend\_pool\_load\_balancing) | Load-balancing settings for the backend pool to determine if the backend is healthy or unhealthy. They also check how to load-balance traffic between different backends in the backend pool. | 
list(object({
    name                            = string
    sample_size                     = optional(number)
    successful_samples_required     = optional(number)
    additional_latency_milliseconds = optional(number)
  }))
| `[]` | no | +| [backend\_pools](#input\_backend\_pools) | A logical grouping of app instances across the world that receive the same traffic and respond with expected behavior. These backends are deployed across different regions or within the same region. All backends can be in `Active/Active` deployment mode or what is defined as `Active/Passive` configuration. Azure by default allows specifying up to `50` Backend Pools. | 
list(object({
    name = string
    backend = object({
      address     = string
      host_header = string
      http_port   = number
      https_port  = number
      priority    = optional(number)
      weight      = optional(number)
    })
    load_balancing_name = string
    health_probe_name   = string
  }))
| `[]` | no | +| [backend\_pools\_send\_receive\_timeout\_seconds](#input\_backend\_pools\_send\_receive\_timeout\_seconds) | Specifies the send and receive timeout on forwarding request to the backend. When the timeout is reached, the request fails and returns. Possible values are between `0` - `240`. Defaults to `60`. | `number` | `60` | no | +| [create\_resource\_group](#input\_create\_resource\_group) | Whether to create resource group and use it for all networking resources | `bool` | `false` | no | +| [enforce\_backend\_pools\_certificate\_name\_check](#input\_enforce\_backend\_pools\_certificate\_name\_check) | Enforce certificate name check on HTTPS requests to all backend pools, this setting will have no effect on HTTP requests. Permitted values are `true` or `false`. | `bool` | `false` | no | +| [fd\_diag\_logs](#input\_fd\_diag\_logs) | Frontdoor Monitoring Category details for Azure Diagnostic setting | `list` | 
[
  "FrontdoorAccessLog",
  "FrontdoorWebApplicationFirewallLog"
]
| no | +| [friendly\_name](#input\_friendly\_name) | A friendly name for the Front Door service. | `string` | `""` | no | +| [frontdoor\_name](#input\_frontdoor\_name) | Specifies the name of the Front Door service. Must be globally unique. | `string` | `""` | no | +| [frontend\_endpoints](#input\_frontend\_endpoints) | Lists all of the frontend endpoints within a Front Door | 
list(object({
    name                                    = string
    host_name                               = string
    session_affinity_enabled                = optional(bool)
    session_affinity_ttl_seconds            = optional(number)
    web_application_firewall_policy_link_id = optional(string)
    custom_https_configuration = optional(object({
      certificate_source                         = optional(string)
      azure_key_vault_certificate_vault_id       = optional(string)
      azure_key_vault_certificate_secret_name    = optional(string)
      azure_key_vault_certificate_secret_version = optional(string)
    }))
  }))
| `[]` | no | +| [location](#input\_location) | The location/region to keep all your network resources. To get the list of all locations with table format from azure cli, run 'az account list-locations -o table' | `string` | `""` | no | +| [log\_analytics\_workspace\_name](#input\_log\_analytics\_workspace\_name) | The name of log analytics workspace name | `any` | `null` | no | +| [resource\_group\_name](#input\_resource\_group\_name) | A container that holds related resources for an Azure solution | `string` | `""` | no | +| [routing\_rules](#input\_routing\_rules) | The list of Routing Rules to determine which particular rule to match the request to and then take the defined action in the configuration | 
list(object({
    name               = string
    frontend_endpoints = list(string)
    accepted_protocols = optional(list(string))
    patterns_to_match  = optional(list(string))
    forwarding_configuration = optional(object({
      backend_pool_name                     = string
      cache_enabled                         = optional(bool)
      cache_use_dynamic_compression         = optional(bool)
      cache_query_parameter_strip_directive = optional(string)
      cache_query_parameters                = optional(list(string))
      cache_duration                        = optional(string)
      custom_forwarding_path                = optional(string)
      forwarding_protocol                   = optional(string)
    }))
    redirect_configuration = optional(object({
      custom_host         = optional(string)
      redirect_protocol   = optional(string)
      redirect_type       = string
      custom_fragment     = optional(string)
      custom_path         = optional(string)
      custom_query_string = optional(string)
    }))
  }))
| `[]` | no | +| [storage\_account\_name](#input\_storage\_account\_name) | The name of the hub storage account to store logs | `any` | `null` | no | +| [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no | +| [web\_application\_firewall\_policy](#input\_web\_application\_firewall\_policy) | Manages an Azure Front Door Web Application Firewall Policy instance. | 
map(object({
    name                              = string
    mode                              = optional(string)
    redirect_url                      = optional(string)
    custom_block_response_status_code = optional(number)
    custom_block_response_body        = optional(string)

    custom_rule = optional(map(object({
      name     = string
      action   = string
      priority = number
      type     = string
      match_condition = object({
        match_variable     = string
        match_values       = list(string)
        operator           = string
        selector           = optional(string)
        negation_condition = optional(bool)
        transforms         = optional(list(string))
      })
      rate_limit_duration_in_minutes = optional(number)
      rate_limit_threshold           = optional(number)
    })))

    managed_rule = optional(map(object({
      type    = string
      version = string
      exclusion = optional(map(object({
        match_variable = string
        operator       = string
        selector       = string
      })))
      override = optional(map(object({
        rule_group_name = string
        exclusion = map(object({
          match_variable = string
          operator       = string
          selector       = string
        }))
        rule = optional(map(object({
          rule_id = string
          action  = string
          enabled = bool
          exclusion = map(object({
            match_variable = string
            operator       = string
            selector       = string
          }))
        })))
      })))
    })))
  }))
| `null` | no | ## Outputs -Name | Description ----- | ----------- -`resource_group_name`| The name of the resource group in which resources are created -`resource_group_id`| The id of the resource group in which resources are created -`resource_group_location`| The location of the resource group in which resources are created -`backend_pool_ids`|The ID's of the Azure Front Door Backend Pool -`backend_pool_health_probes`|The ID's of the Azure Front Door Backend Health Probe -`backend_pool_load_balancing`|The ID of the Azure Front Door Backend Load Balancer -`frontend_endpoint_id`|The ID of the Azure Front Door Frontend Endpoint -`frontdoor_id`|The ID of the FrontDoor -`frontdoor_waf_policy_id`|The ID of the FrontDoor Firewall Policy -`frontdoor_waf_policy_location`|The Azure Region where this FrontDoor Firewall Policy exists -`frontdoor_waf_policy_frontend_endpoint_ids`|The Frontend Endpoints associated with this Front Door Web Application Firewall policy +| Name | Description | +|------|-------------| +| [backend\_pool\_health\_probes](#output\_backend\_pool\_health\_probes) | The ID's of the Azure Front Door Backend Health Probe | +| [backend\_pool\_ids](#output\_backend\_pool\_ids) | The ID's of the Azure Front Door Backend Pool | +| [backend\_pool\_load\_balancing](#output\_backend\_pool\_load\_balancing) | The ID of the Azure Front Door Backend Load Balancer | +| [frontdoor\_id](#output\_frontdoor\_id) | The ID of the FrontDoor | +| [frontdoor\_waf\_policy\_frontend\_endpoint\_ids](#output\_frontdoor\_waf\_policy\_frontend\_endpoint\_ids) | The Frontend Endpoints associated with this Front Door Web Application Firewall policy | +| [frontdoor\_waf\_policy\_id](#output\_frontdoor\_waf\_policy\_id) | The ID of the FrontDoor Firewall Policy | +| [frontdoor\_waf\_policy\_location](#output\_frontdoor\_waf\_policy\_location) | The Azure Region where this FrontDoor Firewall Policy exists | +| [frontend\_endpoint\_id](#output\_frontend\_endpoint\_id) | The ID of the Azure Front Door Frontend Endpoint | +| [resource\_group\_id](#output\_resource\_group\_id) | The id of the resource group in which resources are created | +| [resource\_group\_location](#output\_resource\_group\_location) | The location of the resource group in which resources are created | +| [resource\_group\_name](#output\_resource\_group\_name) | The name of the resource group in which resources are created | + ## Resource Graph diff --git a/main.tf b/main.tf index 76b847d..ad2db0f 100644 --- a/main.tf +++ b/main.tf @@ -39,12 +39,15 @@ data "azurerm_storage_account" "storeacc" { resource "azurerm_frontdoor" "main" { name = format("%s", var.frontdoor_name) resource_group_name = local.resource_group_name - backend_pools_send_receive_timeout_seconds = var.backend_pools_send_receive_timeout_seconds - enforce_backend_pools_certificate_name_check = var.enforce_backend_pools_certificate_name_check load_balancer_enabled = true friendly_name = var.friendly_name tags = merge({ "ResourceName" = format("%s", var.frontdoor_name) }, var.tags, ) + backend_pool_settings { + backend_pools_send_receive_timeout_seconds = var.backend_pools_send_receive_timeout_seconds + enforce_backend_pools_certificate_name_check = var.enforce_backend_pools_certificate_name_check + } + dynamic "backend_pool" { for_each = var.backend_pools content { diff --git a/versions.tf b/versions.tf index e09c19f..689ca46 100644 --- a/versions.tf +++ b/versions.tf @@ -3,7 +3,7 @@ terraform { required_providers { azurerm = { source = "hashicorp/azurerm" - version = ">= 2.59.0" + version = ">= 3.0.0" } } required_version = ">= 0.13"