RSD FrontDoor Terraform project

This project creates and manages the RSD FrontDoor CDN.

Usage

Requirements

Name	Version
terraform	>= 1.11.4
azurerm	>= 4.0.0
null	~> 3.2

Providers

Name	Version
azurerm	4.70.0
null	3.2.4

Resources

Name	Type
azurerm_cdn_frontdoor_custom_domain.rsd	resource
azurerm_cdn_frontdoor_custom_domain_association.rsd	resource
azurerm_cdn_frontdoor_endpoint.rsd	resource
azurerm_cdn_frontdoor_firewall_policy.waf	resource
azurerm_cdn_frontdoor_origin.rsd	resource
azurerm_cdn_frontdoor_origin_group.rsd	resource
azurerm_cdn_frontdoor_profile.rsd	resource
azurerm_cdn_frontdoor_route.rsd	resource
azurerm_cdn_frontdoor_rule.add_response_headers	resource
azurerm_cdn_frontdoor_rule.host_redirects	resource
azurerm_cdn_frontdoor_rule.remove_response_headers	resource
azurerm_cdn_frontdoor_rule.security	resource
azurerm_cdn_frontdoor_rule.vdp_security_txt	resource
azurerm_cdn_frontdoor_rule.vdp_thanks_txt	resource
azurerm_cdn_frontdoor_rule_set.host_redirects	resource
azurerm_cdn_frontdoor_rule_set.response_headers	resource
azurerm_cdn_frontdoor_rule_set.security	resource
azurerm_cdn_frontdoor_rule_set.vdp	resource
azurerm_cdn_frontdoor_security_policy.waf	resource
azurerm_log_analytics_workspace.diagnostics	resource
azurerm_management_lock.rsd_frontdoor	resource
azurerm_monitor_diagnostic_setting.cdn	resource
azurerm_resource_group.rsd_frontdoor	resource
azurerm_storage_account.tfvars	resource
azurerm_storage_account_network_rules.tfvars	resource
azurerm_storage_blob.tfvars	resource
azurerm_storage_container.tfvars	resource
null_resource.tfvars	resource
azurerm_dns_zone.zone	data source
azurerm_resource_group.existing_resource_group	data source

Inputs

Name	Description	Type	Default	Required
azure_client_id	Service Principal Client ID	string	n/a	yes
azure_client_secret	Service Principal Client Secret	string	n/a	yes
azure_location	Azure location in which to launch resources.	string	n/a	yes
azure_subscription_id	Service Principal Subscription ID	string	n/a	yes
azure_tenant_id	Service Principal Tenant ID	string	n/a	yes
enable_frontdoor	Launch the FrontDoor CDN	bool	false	no
enable_frontdoor_vdp_redirects	Creates a redirect rule set for security.txt and thanks.txt to an external Vulnerability Disclosure Program service	bool	true	no
enable_frontdoor_waf	Enable or Disable the Front Door WAF Policy	bool	true	no
enable_resource_group_lock	Enabling this will add a Resource Lock to the Resource Group preventing any resources from being deleted	bool	false	no
environment	Environment name	string	n/a	yes
existing_resource_group	Use an existing resource group instead of launching a new one	string	""	no
frontdoor_enable_access_logs	Enable logging of HTTP Requests	bool	false	no
frontdoor_enable_health_probe_logs	Enable logging of Health Probe results	bool	false	no
frontdoor_enable_waf_logs	Enable logging of WAF events	bool	true	no
frontdoor_profiles	Map of FrontDoor origin objects to add to the FrontDoor CDN	map(map(object({ origin_host = string origin_host_header = optional(string, null) custom_domains = optional(list(string), []) enable_health_probe = optional(bool, true) managed_dns_zones = optional(list(object({ name = string resource_group_name = string })), []) health_probe_interval = optional(number, 60) health_probe_request_type = optional(string, "HEAD") health_probe_path = optional(string, "/") private_link_target_id = optional(string, null) private_link_target_type = optional(string, "managedEnvironments") forwarding_protocol = optional(string, "HttpsOnly") enable_security_headers = optional(bool, true) redirects = optional(list(object({ from = string to = string })), []) add_http_response_headers = optional(list(object({ name = string value = string })), []) remove_http_response_headers = optional(list(object({ name = string })), []) waf_custom_rules = optional(map(object({ action = string match_conditions : map(object({ match_variable : string, match_values : optional(list(string), []), operator : optional(string, "Any"), selector : optional(string, null), negation_condition : optional(bool, false), })) })), {}) })))	{}	no
frontdoor_response_timeout	Maximum FrontDoor response timeout in seconds	number	120	no
frontdoor_sku	FrontDoor SKU	string	"Premium_AzureFrontDoor"	no
frontdoor_vdp_destination_hostname	Requires 'enable_frontdoor_vdp_redirects' to be set to 'true'. Hostname to redirect security.txt and thanks.txt to	string	"vdp.security.education.gov.uk"	no
tags	Tags to be applied to all resources	map(string)	{}	no
tfvars_filename	tfvars filename. This file is uploaded and stored encrypted within Key Vault, to ensure that the latest tfvars are stored in a shared place.	string	n/a	yes
waf_enable_bot_protection	Enable Bot Protection rules in the WAF Policy	bool	true	no
waf_enable_rate_limiting	Enable a Rate Limit rule in the WAF Policy	bool	true	no
waf_mode	Set whether the WAF is in Detection or Prevention mode	string	"Detection"	no
waf_rate_limiting_bypass_ip_list	List of IPv4 Addresses that should bypass the Rate Limit rules	list(string)	[]	no
waf_rate_limiting_duration_in_minutes	Number of minutes to block an IP address when it exceeds rate limit	number	5	no
waf_rate_limiting_threshold	Number of evaluated requests that are permitted within 'waf_rate_limiting_duration_in_minutes' before being rate limited	number	200	no

Outputs

No outputs.