Skip to content

README.md

Latest commit

 

History

History
94 lines (81 loc) · 12 KB

README.md

File metadata and controls

94 lines (81 loc) · 12 KB
Raw

RSD FrontDoor Terraform project

Terraform CI

This project creates and manages the RSD FrontDoor CDN.

Usage

Requirements

Name Version
terraform >= 1.11.4
azurerm >= 4.0.0
null ~> 3.2

Providers

Name Version
azurerm 4.70.0
null 3.2.4

Resources

Name Type
azurerm_cdn_frontdoor_custom_domain.rsd resource
azurerm_cdn_frontdoor_custom_domain_association.rsd resource
azurerm_cdn_frontdoor_endpoint.rsd resource
azurerm_cdn_frontdoor_firewall_policy.waf resource
azurerm_cdn_frontdoor_origin.rsd resource
azurerm_cdn_frontdoor_origin_group.rsd resource
azurerm_cdn_frontdoor_profile.rsd resource
azurerm_cdn_frontdoor_route.rsd resource
azurerm_cdn_frontdoor_rule.add_response_headers resource
azurerm_cdn_frontdoor_rule.host_redirects resource
azurerm_cdn_frontdoor_rule.remove_response_headers resource
azurerm_cdn_frontdoor_rule.security resource
azurerm_cdn_frontdoor_rule.vdp_security_txt resource
azurerm_cdn_frontdoor_rule.vdp_thanks_txt resource
azurerm_cdn_frontdoor_rule_set.host_redirects resource
azurerm_cdn_frontdoor_rule_set.response_headers resource
azurerm_cdn_frontdoor_rule_set.security resource
azurerm_cdn_frontdoor_rule_set.vdp resource
azurerm_cdn_frontdoor_security_policy.waf resource
azurerm_log_analytics_workspace.diagnostics resource
azurerm_management_lock.rsd_frontdoor resource
azurerm_monitor_diagnostic_setting.cdn resource
azurerm_resource_group.rsd_frontdoor resource
azurerm_storage_account.tfvars resource
azurerm_storage_account_network_rules.tfvars resource
azurerm_storage_blob.tfvars resource
azurerm_storage_container.tfvars resource
null_resource.tfvars resource
azurerm_dns_zone.zone data source
azurerm_resource_group.existing_resource_group data source

Inputs

Name Description Type Default Required
azure_client_id Service Principal Client ID string n/a yes
azure_client_secret Service Principal Client Secret string n/a yes
azure_location Azure location in which to launch resources. string n/a yes
azure_subscription_id Service Principal Subscription ID string n/a yes
azure_tenant_id Service Principal Tenant ID string n/a yes
enable_frontdoor Launch the FrontDoor CDN bool false no
enable_frontdoor_vdp_redirects Creates a redirect rule set for security.txt and thanks.txt to an external Vulnerability Disclosure Program service bool true no
enable_frontdoor_waf Enable or Disable the Front Door WAF Policy bool true no
enable_resource_group_lock Enabling this will add a Resource Lock to the Resource Group preventing any resources from being deleted bool false no
environment Environment name string n/a yes
existing_resource_group Use an existing resource group instead of launching a new one string "" no
frontdoor_enable_access_logs Enable logging of HTTP Requests bool false no
frontdoor_enable_health_probe_logs Enable logging of Health Probe results bool false no
frontdoor_enable_waf_logs Enable logging of WAF events bool true no
frontdoor_profiles Map of FrontDoor origin objects to add to the FrontDoor CDN 
map(map(object({
    origin_host         = string
    origin_host_header  = optional(string, null)
    custom_domains      = optional(list(string), [])
    enable_health_probe = optional(bool, true)
    managed_dns_zones = optional(list(object({
      name                = string
      resource_group_name = string
    })), [])
    health_probe_interval     = optional(number, 60)
    health_probe_request_type = optional(string, "HEAD")
    health_probe_path         = optional(string, "/")
    private_link_target_id    = optional(string, null)
    private_link_target_type  = optional(string, "managedEnvironments")
    forwarding_protocol       = optional(string, "HttpsOnly")
    enable_security_headers   = optional(bool, true)
    redirects = optional(list(object({
      from = string
      to   = string
    })), [])
    add_http_response_headers = optional(list(object({
      name  = string
      value = string
    })), [])
    remove_http_response_headers = optional(list(object({
      name = string
    })), [])
    waf_custom_rules = optional(map(object({
      action = string
      match_conditions : map(object({
        match_variable : string,
        match_values : optional(list(string), []),
        operator : optional(string, "Any"),
        selector : optional(string, null),
        negation_condition : optional(bool, false),
      }))
    })), {})
  })))
 {} no
frontdoor_response_timeout Maximum FrontDoor response timeout in seconds number 120 no
frontdoor_sku FrontDoor SKU string "Premium_AzureFrontDoor" no
frontdoor_vdp_destination_hostname Requires 'enable_frontdoor_vdp_redirects' to be set to 'true'. Hostname to redirect security.txt and thanks.txt to string "vdp.security.education.gov.uk" no
tags Tags to be applied to all resources map(string) {} no
tfvars_filename tfvars filename. This file is uploaded and stored encrypted within Key Vault, to ensure that the latest tfvars are stored in a shared place. string n/a yes
waf_enable_bot_protection Enable Bot Protection rules in the WAF Policy bool true no
waf_enable_rate_limiting Enable a Rate Limit rule in the WAF Policy bool true no
waf_mode Set whether the WAF is in Detection or Prevention mode string "Detection" no
waf_rate_limiting_bypass_ip_list List of IPv4 Addresses that should bypass the Rate Limit rules list(string) [] no
waf_rate_limiting_duration_in_minutes Number of minutes to block an IP address when it exceeds rate limit number 5 no
waf_rate_limiting_threshold Number of evaluated requests that are permitted within 'waf_rate_limiting_duration_in_minutes' before being rate limited number 200 no

Outputs

No outputs.