Add module for Storage account static website hosted on CDN Frontdoor#192
Merged
SazniMohamed merged 2 commits intowso2:mainfrom Jan 6, 2026
Merged
Add module for Storage account static website hosted on CDN Frontdoor#192SazniMohamed merged 2 commits intowso2:mainfrom
SazniMohamed merged 2 commits intowso2:mainfrom
Conversation
WalkthroughAdds an Azure Storage account configured for static website hosting, an Azure CDN Front Door profile and endpoint, new input variables and provider/version constraints, and outputs exposing storage and CDN attributes including the CDN endpoint hostname. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant TF as Terraform
participant Prov as azurerm provider
participant RG as Resource Group
participant SA as Storage Account
participant CDNProf as CDN Front Door Profile
participant CDNEp as CDN Front Door Endpoint
rect `#E8F4FF`
Note over TF,Prov: Create storage account (static website)
TF->>Prov: apply azurerm_storage_account.static_storage
Prov->>RG: allocate resources in `resource_group_name`
Prov->>SA: create storage account, enable static website, apply network rules
end
rect `#F2FFF0`
Note over TF,Prov: Create CDN Front Door profile and endpoint
TF->>Prov: apply azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile
Prov->>CDNProf: create profile (sku, timeout, tags)
TF->>Prov: apply azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint
Prov->>CDNEp: create endpoint (enabled, tags)
CDNProf->>CDNEp: profile id referenced by endpoint
end
Note over SA,CDNEp: Outputs expose storage and CDN attributes (including endpoint hostname)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Pre-merge checks❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Fix all issues with AI Agents 🤖
In
@modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf:
- Around line 30-35: The resource azurerm_cdn_frontdoor_endpoint references
undefined variables cdn_frontdoor_endpoint_abbreviation,
cdn_frontdoor_endpoint_name, and enabled; add corresponding variable blocks to
variables.tf: define variable "cdn_frontdoor_endpoint_abbreviation" as a string
with a descriptive comment and a sensible default (e.g., "fde"), define variable
"cdn_frontdoor_endpoint_name" as a required string with a description, and
define variable "enabled" as a bool with a description and default true; ensure
names exactly match the references in the resource so terraform init/plan
succeed.
- Around line 21-35: The CDN Front Door endpoint is not connected to the storage
account; add an azurerm_cdn_frontdoor_origin_group resource and an
azurerm_cdn_frontdoor_origin that points to
azurerm_storage_account.static_storage.primary_web_host, then create an
azurerm_cdn_frontdoor_route that links
azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint to the origin_group;
ensure the origin uses the storage account host as the host_name, sets
appropriate http_port/https_port and priority/weight, reference
azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile.id for the profile linkage,
and use tags/enablement values consistent with the existing
azurerm_cdn_frontdoor_profile and azurerm_cdn_frontdoor_endpoint resources.
- Around line 21-28: The azurerm_cdn_frontdoor_profile resource
(azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile) references two undefined
variables (cdn_frontdoor_profile_abbreviation and cdn_frontdoor_profile_name);
add corresponding variable blocks to variables.tf: define
cdn_frontdoor_profile_abbreviation as a string (suggest default "afd") with a
description, and define cdn_frontdoor_profile_name as a required string with a
description so Terraform init won’t fail when join("-",
[var.cdn_frontdoor_profile_abbreviation, var.cdn_frontdoor_profile_name]) is
evaluated.
In
@modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/storage_account_static_website.tf:
- Around line 21-22: The storage account name built in
azurerm_storage_account.static_storage uses a "st" prefix plus
var.storage_account_name but there is no validation that
var.storage_account_name meets Azure constraints (3–24 total chars, lowercase
alphanumeric), which can cause deployment failures; add a validation block to
the storage_account_name variable (variable "storage_account_name") that uses a
regex to enforce only lowercase letters and digits and a max length of 22
characters (since "st" adds 2), and include a clear error_message explaining the
1–22 char lowercase alphanumeric requirement and that the "st" prefix is added
automatically.
In @modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf:
- Around line 85-89: The variable network_rules_bypass has a mismatched
description: it currently says "Defaults to []" while the default is
["AzureServices"]; update the description to reflect the actual default (e.g.,
"List of actions that bypass the network rule. Defaults to [\"AzureServices\"]")
or change the default to [] if that was intended; locate the variable block
named network_rules_bypass and either adjust the description text to match the
default value or change the default value to match the original description.
- Around line 31-34: The variable declaration variable "resource_group_name" has
a copy-paste description mentioning "EventHub Namespace"; update the description
to accurately describe that this is the name of the resource group containing
the Storage Account (or static website) used by this module—edit the description
string in the variable "resource_group_name" block to reference the storage
account/resource group rather than EventHub Namespace.
🧹 Nitpick comments (2)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/versions.tf (1)
22-22: Consider updating the Terraform version constraint.For new modules,
required_version = ">= 1.0.0"or higher is recommended, as Terraform 0.13 dates back to 2020 and lacks many stability and feature improvements from later releases.🔎 Suggested update
- required_version = ">= 0.13" + required_version = ">= 1.0.0"modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tf (1)
21-64: Consider removing redundantdepends_onfrom outputs.Terraform automatically tracks dependencies through resource references in output values, making explicit
depends_ondeclarations unnecessary. These can be safely removed to simplify the code.🔎 Simplified outputs
output "storage_account_name" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.name } output "storage_account_id" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.id }Apply similar changes to all other outputs in this file.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/storage_account_static_website.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/versions.tf
🧰 Additional context used
🪛 Checkov (3.2.334)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/storage_account_static_website.tf
[medium] 21-54: Ensure storage account is configured with private endpoint
(CKV2_AZURE_33)
[high] 21-54: Ensure storage for critical data are encrypted with Customer Managed Key
(CKV2_AZURE_1)
🔇 Additional comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/storage_account_static_website.tf (1)
21-54: Consider security recommendations from static analysis.The static analysis tools flag two security concerns:
- Private endpoint configuration: Public access to storage accounts can be restricted using private endpoints
- Customer-managed keys (CMK): Encryption with CMK provides additional control over key management
These are valid security recommendations but may be optional depending on your organization's security posture and compliance requirements. Evaluate whether these controls are needed for your use case.
Based on learnings from static analysis hints.
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
Show resolved
Hide resolved
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
Show resolved
Hide resolved
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
Show resolved
Hide resolved
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/storage_account_static_website.tf
Show resolved
Hide resolved
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (2)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf (2)
31-34: Fix copy-paste error in description.The description still references "EventHub Namespace" but this variable is for the resource group containing the storage account and CDN resources.
🔎 Corrected description
variable "resource_group_name" { - description = "Name of the resource group in which the EventHub Namespace exists" + description = "Name of the resource group in which the resources will be created" type = string }
85-89: Fix inconsistent default value description.The description states "Defaults to []" but the actual default is
["AzureServices"].🔎 Corrected description
variable "network_rules_bypass" { default = ["AzureServices"] - description = "List of actions that bypass the network rule. Defaults to []" + description = "List of actions that bypass the network rule. Defaults to [\"AzureServices\"]" type = list(string) }
🧹 Nitpick comments (3)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf (3)
36-44: Add validation constraints for Azure-specific values.Consider adding validation blocks to ensure only valid Azure values are accepted for
account_tierandaccount_replication_type.🔎 Suggested validation constraints
variable "account_tier" { description = "Defines the Tier to use for this storage account" type = string + validation { + condition = contains(["Standard", "Premium"], var.account_tier) + error_message = "Account tier must be either 'Standard' or 'Premium'." + } } variable "account_replication_type" { description = "Defines the type of replication to use for this storage account" type = string + validation { + condition = contains(["LRS", "GRS", "RAGRS", "ZRS", "GZRS", "RAGZRS"], var.account_replication_type) + error_message = "Account replication type must be one of: LRS, GRS, RAGRS, ZRS, GZRS, RAGZRS." + } }
67-71: Add validation for network rules default action.Consider adding a validation block to ensure only valid Azure network rule actions are accepted.
🔎 Suggested validation constraint
variable "network_rules_default_action" { default = "Deny" description = "The default action of allow or deny when no other rules match" type = string + validation { + condition = contains(["Allow", "Deny"], var.network_rules_default_action) + error_message = "Network rules default action must be either 'Allow' or 'Deny'." + } }
96-99: Add validation for CDN Front Door SKU names.The
cdn_frontdoor_profile_sku_namevariable should include a validation block to enforce only valid Azure CDN Front Door SKU names.Suggested validation constraint
variable "cdn_frontdoor_profile_sku_name" { description = "The pricing tier of the CDN Frontdoor profile" type = string + validation { + condition = contains(["Standard_AzureFrontDoor", "Premium_AzureFrontDoor"], var.cdn_frontdoor_profile_sku_name) + error_message = "CDN Front Door profile SKU must be either 'Standard_AzureFrontDoor' or 'Premium_AzureFrontDoor'." + } }
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
🔇 Additional comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf (1)
118-122: Response timeout value is correct.The default of 240 seconds is valid and represents the maximum allowed response timeout for Azure CDN Front Door profiles (range: 16–240 seconds).
SazniMohamed
force-pushed
the
main-jan-5
branch
from
9cf9b02 to
032f61a
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI Agents
In @modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf:
- Around line 31-34: The variable resource_group_name has a copy-paste
description mentioning "EventHub Namespace"; update the description to
accurately describe this variable (it is the name of the resource group
containing the Storage Account, Static Website, CDN and Front Door resources).
Locate the variable block for resource_group_name and replace the description
string accordingly so it reflects the storage/CDN/frontdoor context instead of
EventHub Namespace.
- Around line 85-89: The variable "network_rules_bypass" has a mismatched
description stating "Defaults to []" while its actual default is
["AzureServices"]; update the description in variables.tf for the variable
network_rules_bypass to reflect the real default (e.g., "List of actions that
bypass the network rule. Defaults to [\"AzureServices\"]") so documentation
matches the declared default value.
d1e1390 to
2139510
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI Agents
In @modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf:
- Around line 26-29: The variable "resource_group_name" has a copy-paste
description referencing "EventHub Namespace"; update the variable's description
to accurately describe its purpose (e.g., "Name of the resource group containing
the Storage Account, CDN and Front Door resources" or similar) so it reflects
that this variable is for the storage account/CDN/Front Door resources rather
than EventHub Namespace; modify the description string in the variable block
named resource_group_name accordingly.
- Around line 80-84: The variable network_rules_bypass has a mismatched
description and default; update the variable "network_rules_bypass" description
to reflect the actual default value (["AzureServices"]) or change the default to
match the described empty list—pick one consistent approach; ensure the
description text explicitly states the real default (e.g., "Defaults to
[\"AzureServices\"]") so the variable's description and default align.
🧹 Nitpick comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf (1)
31-34: Consider adding validation constraints for enum-like variables.Variables
account_tier,account_replication_type, andcdn_frontdoor_profile_sku_nameaccept only specific Azure-defined values. Adding validation blocks would catch configuration errors earlier and improve the module's usability.Example validation blocks
variable "account_tier" { description = "Defines the Tier to use for this storage account" type = string + validation { + condition = contains(["Standard", "Premium"], var.account_tier) + error_message = "account_tier must be either 'Standard' or 'Premium'." + } } variable "account_replication_type" { description = "Defines the type of replication to use for this storage account" type = string + validation { + condition = contains(["LRS", "GRS", "RAGRS", "ZRS", "GZRS", "RAGZRS"], var.account_replication_type) + error_message = "account_replication_type must be one of: LRS, GRS, RAGRS, ZRS, GZRS, RAGZRS." + } } variable "cdn_frontdoor_profile_sku_name" { description = "The pricing tier of the CDN Frontdoor profile" type = string + validation { + condition = contains(["Standard_AzureFrontDoor", "Premium_AzureFrontDoor"], var.cdn_frontdoor_profile_sku_name) + error_message = "cdn_frontdoor_profile_sku_name must be either 'Standard_AzureFrontDoor' or 'Premium_AzureFrontDoor'." + } }Also applies to: 36-39, 91-94
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
🚧 Files skipped from review as they are similar to previous changes (1)
- modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
SazniMohamed
force-pushed
the
main-jan-5
branch
from
2139510 to
d401035
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI Agents
In @modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf:
- Around line 80-84: The variable declaration for network_rules_bypass has a
mismatched description and default; update the description for variable
"network_rules_bypass" to reflect the actual default value (e.g., change
"Defaults to []" to "Defaults to [\"AzureServices\"]") so the description
matches the default, or alternatively change the default to [] if that was
intended—edit the description string in the variable block to correct this
inconsistency.
- Around line 26-29: The variable "resource_group_name" has a copy-paste
description referencing an EventHub Namespace; update its description to
accurately reflect its purpose for this module by replacing the text with
something like: "Name of the resource group containing the Storage Account, CDN,
and Front Door resources." Ensure the change is made on the variable block for
resource_group_name.
- Around line 113-117: The variable response_timeout_seconds currently defaults
to 240 (max); update its default to 30 to match Azure Front Door recommended
default. Locate the variable block for response_timeout_seconds and change
default = 240 to default = 30, keeping the description and type intact unless a
longer timeout is explicitly required.
🧹 Nitpick comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tf (1)
21-64: Consider removing redundantdepends_ondeclarations.Terraform automatically establishes dependencies when outputs reference resource attributes, making explicit
depends_ondeclarations unnecessary in these output blocks. Remove them unless you're working around a specific provider issue.🔎 Simplified output blocks
output "storage_account_name" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.name } output "storage_account_id" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.id } output "storage_account_primary_web_endpoint" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.primary_web_endpoint } output "storage_account_primary_web_host" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.primary_web_host } output "storage_account_secondary_web_endpoint" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.secondary_web_endpoint } output "cdn_frontdoor_profile_name" { - depends_on = [azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile] value = azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile.name } output "cdn_frontdoor_profile_id" { - depends_on = [azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile] value = azurerm_cdn_frontdoor_profile.cdn_frontdoor_profile.id } output "cdn_frontdoor_endpoint_hostname" { - depends_on = [azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint] value = azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint.host_name } output "cdn_frontdoor_endpoint_id" { - depends_on = [azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint] value = azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint.id }
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
🚧 Files skipped from review as they are similar to previous changes (1)
- modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
🔇 Additional comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tf (1)
56-59: Thehost_nameattribute is valid. Theazurerm_cdn_frontdoor_endpointresource exportshost_nameas documented in the official Terraform provider, and the output correctly uses this attribute.
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
Show resolved
Hide resolved
SazniMohamed
force-pushed
the
main-jan-5
branch
2 times, most recently
from
deb40d8 to
b431096
Compare
SazniMohamed
force-pushed
the
main-jan-5
branch
from
b431096 to
8a5beb1
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI Agents
In @modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf:
- Around line 26-29: Update the variable "resource_group_name" description to be
specific to this module by stating that the named resource group will contain
the Storage Account (static website), CDN, and Front Door resources managed by
this module; locate the variable "resource_group_name" in variables.tf and
replace the generic description with a concise, module-specific description
referencing Storage Account, CDN, and Front Door.
- Around line 80-84: Update the variable description for network_rules_bypass to
explicitly document its default value; modify the description string in the
variable "network_rules_bypass" so it mentions that the default is
["AzureServices"] (e.g., "List of actions that bypass the network rule. Default:
[\"AzureServices\"]") to make the default behavior clear.
🧹 Nitpick comments (1)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tf (1)
21-64: Consider removing redundantdepends_onmeta-arguments.Terraform automatically infers dependencies from resource attribute references in
valueexpressions. The explicitdepends_ondeclarations add no functional benefit and can be safely removed for cleaner code.🔎 Simplified outputs (example)
output "storage_account_name" { - depends_on = [azurerm_storage_account.static_storage] value = azurerm_storage_account.static_storage.name } output "cdn_frontdoor_endpoint_hostname" { - depends_on = [azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint] value = azurerm_cdn_frontdoor_endpoint.cdn_frontdoor_endpoint.host_name }Apply the same pattern to all outputs in this file.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/outputs.tfmodules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
🚧 Files skipped from review as they are similar to previous changes (1)
- modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/cdn_frontdoor.tf
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
Show resolved
Hide resolved
modules/azurerm/Storage-Account-Static-Website-CDN-FrontDoor/variables.tf
Show resolved
Hide resolved
athiththan11
approved these changes
Jan 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.