This module provisions an Azure Front Door Standard/Premium profile in front of a backend origin (e.g. Azure Container Apps). It creates a Front Door profile, endpoint, origin group with health probe, origin, and route — all configurable through input variables with safe, production-ready defaults.
See examples/basic for a minimal working example.
| Name | Version |
|---|---|
| terraform | >= 1.0.0, <=1.5.7 |
| azurerm | >= 4.0.0, < 5.0.0 |
| Name | Version |
|---|---|
| azurerm | 4.81.0 |
No modules.
| Name | Type |
|---|---|
| azurerm_cdn_frontdoor_custom_domain.this | resource |
| azurerm_cdn_frontdoor_custom_domain_association.this | resource |
| azurerm_cdn_frontdoor_endpoint.this | resource |
| azurerm_cdn_frontdoor_origin.this | resource |
| azurerm_cdn_frontdoor_origin_group.this | resource |
| azurerm_cdn_frontdoor_profile.this | resource |
| azurerm_cdn_frontdoor_route.this | resource |
| azurerm_cdn_frontdoor_rule.disable_cache_control | resource |
| azurerm_cdn_frontdoor_rule.disable_proxy_buffering | resource |
| azurerm_cdn_frontdoor_rule_set.disable_cache | resource |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| certificate_name_check_enabled | Enable TLS certificate name checks between Front Door and origin. | bool |
true |
no |
| custom_domain | Optional custom domain configuration. | object({ |
null |
no |
| custom_domain_dns_zone_id | DEPRECATED: Use var.custom_domain instead. | string |
null |
no |
| custom_domain_host_name | DEPRECATED: Use var.custom_domain instead. | string |
null |
no |
| disable_cache_for_paths | Optional list of URL path prefixes to disable caching for (e.g. ['/api/', '/mcp/']). Useful for SSE streams and real-time endpoints. | list(string) |
[] |
no |
| enabled | When false, endpoint, origin and route are created in disabled state. | bool |
true |
no |
| endpoint_name_override | Override the auto-generated Front Door endpoint name. | string |
null |
no |
| environment | Deployment environment. Valid values: production, development, test, staging, uat, sandbox, poc. | string |
n/a | yes |
| forwarding_protocol | Protocol used by Front Door when forwarding traffic to the origin. | string |
"HttpsOnly" |
no |
| health_probe_interval_in_seconds | Interval in seconds between health probes. Azure accepts 5–31536000. | number |
120 |
no |
| health_probe_path | Health probe path for origin checks. | string |
"/healthz" |
no |
| health_probe_protocol | Protocol used for origin health probing. | string |
"Https" |
no |
| health_probe_request_type | HTTP method used for origin health probing. | string |
"GET" |
no |
| https_redirect_enabled | When true, HTTP requests are redirected to HTTPS. | bool |
true |
no |
| link_to_default_domain | When true, the route is linked to the default *.azurefd.net endpoint host. | bool |
true |
no |
| load_balancing_additional_latency_in_milliseconds | Additional latency used by Front Door load balancing algorithm. | number |
0 |
no |
| load_balancing_sample_size | Sample size used by Front Door load balancing algorithm. | number |
4 |
no |
| load_balancing_successful_samples_required | Successful sample count required by Front Door load balancing algorithm. | number |
3 |
no |
| location | Azure region where Front Door resources are managed from. | string |
n/a | yes |
| name_override | Override the auto-generated Front Door profile name. | string |
null |
no |
| origin_fqdn | FQDN of the backend origin, for example a Container App ingress hostname. | string |
n/a | yes |
| origin_group_name_override | Override the auto-generated Front Door origin group name. | string |
null |
no |
| origin_host_header | Optional host header sent to the origin. Defaults to origin_fqdn. | string |
null |
no |
| origin_http_port | Origin HTTP port. | number |
80 |
no |
| origin_https_port | Origin HTTPS port. | number |
443 |
no |
| origin_name_override | Override the auto-generated Front Door origin name. | string |
null |
no |
| origin_priority | Priority of the origin in the origin group. Azure accepts 1–5. | number |
1 |
no |
| origin_weight | Weight of the origin in the origin group. Azure accepts 1–1000. | number |
1000 |
no |
| patterns_to_match | URL path patterns matched by the route. | list(string) |
[ |
no |
| resource_group_name | Resource group where the Front Door profile will be deployed. | string |
n/a | yes |
| response_timeout_seconds | The response timeout in seconds | number |
120 |
no |
| restore_traffic_time_minutes | Minutes Front Door waits before fully restoring traffic to a healed origin. Azure accepts 0–50. | number |
10 |
no |
| route_name | Name of the Front Door route. Must be 1–90 characters, alphanumeric and hyphens only. | string |
"default" |
no |
| session_affinity_enabled | Enable session affinity on the origin group. | bool |
false |
no |
| sku_name | Front Door profile SKU. | string |
"Standard_AzureFrontDoor" |
no |
| suffix | Optional suffix appended to generated Front Door resource names. Must be lowercase alphanumeric and hyphens only, max 10 characters. | string |
null |
no |
| supported_protocols | Protocols accepted by the endpoint route. | list(string) |
[ |
no |
| tags | Additional tags to apply. Merged with module-managed tags (managed_by, environment, workload). | map(string) |
{} |
no |
| workload | Name of the workload or application. Used in resource naming and tagging. | string |
n/a | yes |
| Name | Description |
|---|---|
| front_door_endpoint_id | Resource ID of the Front Door endpoint. |
| front_door_hostname | Default Azure Front Door hostname (*.azurefd.net) of the endpoint. |
| front_door_origin_group_id | Resource ID of the Front Door origin group. |
| front_door_origin_id | Resource ID of the Front Door origin. |
| front_door_profile_id | Resource ID of the Front Door profile. |
| front_door_profile_name | Name of the Front Door profile. |
| front_door_route_id | Resource ID of the Front Door route. |
Module managed by Zoi.
MIT License. See LICENSE for full details.