IaC Bazaar
AzureLive-tested

Azure Front Door (Std/Premium) + WAF

Global entry point: Front Door profile, endpoints, origin groups, custom domains with managed TLS and WAF policy.

terraformAzure#azure

Compare CDN & Edge Delivery across clouds →

azure-front-doorterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-08-04 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o azure-front-door-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/azure-front-door/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle azure-front-door-1.0.0.sigstore.json \
  azure-front-door-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "2c1d6a0acf26005fb3dc6539e6ef29f3b668d06a99510c7e06d566df3419f455  azure-front-door-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "front_door" {
  source  = "www.iac-bazaar.com/iac-bazaar/azure-front-door/azure"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Professional, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

azure-front-door

Status: static-validated, live-test pending. Ships under live-test quarantine — a Front Door profile costs ~$35/mo base plus traffic, custom domain validation needs control of a real DNS zone, and managed-TLS issuance is asynchronous, none of which exist in a CI sandbox yet. The full apply → verify → destroy gate runs once an Azure sandbox subscription is wired up. Schema is validated against the azurerm v4 provider docs (built against 4.76).

Global L7 entry point built on Azure Front Door (Standard/Premium): one profile, a managed endpoint, origin groups + origins, routes, optional custom domains with Front Door-managed TLS, and a Web Application Firewall policy bound to every fronted domain. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

The Front Door object graph is a set of cross-referencing resources (profile → endpoint/origin-group → origin → route, plus a separate firewall-policy → security-policy chain). This module flattens origins into group/origin-keyed instances, wires each route to the origin IDs it must depend on (Front Door requires this for correct create/destroy ordering), and attaches the WAF to the endpoint and all custom domains through one security policy.

Secure defaults

  • WAF on by default in Prevention mode, bound to the endpoint and every custom domain via a security policy — nothing is fronted without the firewall.
  • Premium SKU by default so the managed Microsoft DefaultRuleSet + BotManager rule sets are available (managed rules are Premium-only; on Standard only custom rules apply, enforced by a precondition).
  • Routes forward HttpsOnly to origins and redirect HTTP → HTTPS.
  • Origin certificate name checks on; custom domains use managed TLS 1.2+ (auto-renewing, no certificate material in state).
  • Lock your origins to this profile using the resource_guid output as the X-Azure-FDID header so the backend only accepts traffic from your Front Door.

License

Commercial — LicenseRef-IaCBazaar-Commercial

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs
  • Requirements & notes

Related modules

Azure✓ live-tested

Application Gateway v2 + WAF

Regional L7 load balancer with WAF v2 policy, TLS termination from Key Vault, autoscaling and health probes.

$59.00v1.0.0
Azure✓ live-tested

Azure Standard Load Balancer (L4)

An Azure Standard L4 load balancer with a self-created static public IP frontend, a backend address pool, health probes and load-balancing rules - Standard SKU throughout.

$59.00v1.0.0
Azure✓ live-tested

Azure Traffic Manager Profile

Global, DNS-based load balancing with a Traffic Manager profile and map-driven external endpoints - Performance, Priority, Weighted, Geographic, Subnet or MultiValue routing with an HTTPS health probe.

$59.00v1.0.0
AkamaiEdge & DNS

Akamai Ion Delivery Property

End-to-end Ion CDN property: origin, edge hostname, caching/performance rule tree, CP code, and staging/production activation.

$59.00v1.0.0
AWSAWS

CloudFront Site (S3 + ACM + Route53)

Complete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records.

$59.00v1.0.0