Azure Application Gateway

This Terraform module creates an Application Gateway associated with a Public IP and with a Subnet, a Network Security Group and network security rules authorizing port 443 and ports for internal healthcheck of Application Gateway. The Diagnostics Logs are activated.

Naming

Resource naming is based on the Microsoft CAF naming convention best practices. Legacy naming is available by setting the parameter usecaf_naming to false. We rely on the official Terraform Azure CAF naming provider to generate resource names.

Global versioning rule for Claranet Azure modules

| Module version | Terraform version | OpenTofu version | AzureRM version | | -------------- | ----------------- | ---------------- | --------------- | | >= 8.x.x | Unverified | 1.8.x | >= 4.0 | | >= 7.x.x | 1.3.x | | >= 3.0 | | >= 6.x.x | 1.x | | >= 3.0 | | >= 5.x.x | 0.15.x | | >= 2.0 | | >= 4.x.x | 0.13.x / 0.14.x | | >= 2.0 | | >= 3.x.x | 0.12.x | | >= 2.0 | | >= 2.x.x | 0.12.x | | < 2.0 | | < 2.x.x | 0.11.x | | < 2.0 |

Contributing

If you want to contribute to this repository, feel free to use our pre-commit git hook configuration which will help you automatically update and format some files for you by enforcing our Terraform code module best-practices.

More details are available in the CONTRIBUTING.md file.

Usage

This module is optimized to work with the Claranet terraform-wrapper tool which set some terraform variables in the environment needed by this module. More details about variables set by the terraform-wrapper available in the documentation.

⚠️ Since modules version v8.0.0, we do not maintain/check anymore the compatibility with Hashicorp Terraform. Instead, we recommend to use OpenTofu.

module "azurevirtualnetwork" {
  source  = "claranet/vnet/azurerm"
  version = "x.x.x"
location       = module.azure_region.location   locationshort = module.azureregion.location_short   clientname    = var.clientname   environment    = var.environment   stack          = var.stack
resourcegroupname = module.rg.name
cidrs = ["192.168.0.0/16"] }
module "waf_policy" {   source  = "claranet/waf-policy/azurerm"   version = "x.x.x"
location       = module.azure_region.location   locationshort = module.azureregion.location_short   clientname    = var.clientname   environment    = var.environment   stack          = var.stack
resourcegroupname = module.rg.name
managedruleset_configuration = [     {       type    = "Microsoft_BotManagerRuleSet"       version = "1.0"     },     {       type    = "Microsoft_DefaultRuleSet"       version = "2.1"     },   ] }
locals {   basename = "${var.stack}-${var.clientname}-${module.azureregion.locationshort}-${var.environment}" }
module "appgw" {   source  = "claranet/app-gateway/azurerm"   version = "x.x.x"
location       = module.azure_region.location   locationshort = module.azureregion.location_short   clientname    = var.clientname   environment    = var.environment   stack          = var.stack
resourcegroupname = module.rg.name
virtualnetworkname = module.azurevirtualnetwork.name   subnet_cidr          = "192.168.1.0/24"
firewallpolicyid                = module.waf_policy.id   forcefirewallpolicy_association = true
backendhttpsettings = [     {       name                  = "${local.base_name}-backhttpsettings-http"       cookiebasedaffinity = "Disabled"       path                  = "/"       port                  = 80       protocol              = "Http"       request_timeout       = 300     },     # {     #   name                  = "${local.base_name}-backhttpsettings-https"     #   cookiebasedaffinity = "Disabled"     #   path                  = "/"     #   port                  = 443     #   protocol              = "Https"     #   request_timeout       = 300     # }   ]
backendaddresspools = [{     name  = "${local.base_name}-backendpool"     fqdns = ["example.com"]   }]
requestroutingrules = [     {       name                       = "${local.base_name}-routing-http"       rule_type                  = "Basic"       httplistenername         = "${local.base_name}-listener-http"       backendaddresspoolname  = "${local.basename}-backendpool"       backendhttpsettingsname = "${local.basename}-backhttpsettings-http"     },     # {     #   name                       = "${local.base_name}-routing-https"     #   rule_type                  = "Basic"     #   httplistenername         = "${local.base_name}-listener-https"     #   backendaddresspoolname  = "${local.basename}-backendpool"     #   backendhttpsettingsname = "${local.basename}-backhttpsettings-https"     # }   ]
frontendipconfigurationcustomname = "${local.base_name}-frontipconfig"
http_listeners = [     {       name                           = "${local.base_name}-listener-http"       frontendipconfigurationname = "${local.basename}-frontipconfig"       frontendportname             = "frontend-http-port"       protocol                       = "Http"       host_name                      = "example.com"     },     # {     #   name                           = "${local.base_name}-listener-https"     #   frontendipconfigurationname = "${local.basename}-frontipconfig"     #   frontendportname             = "frontend-https-port"     #   protocol                       = "Https"     #   sslcertificatename           = "${local.base_name}-example-com-sslcert"     #   require_sni                    = true     #   host_name                      = "example.com"     # }   ]
frontend_ports = [{     name = "frontend-http-port"     port = 80   }]
#  ssl_certificates = [{   #    name     = "${local.base_name}-example-com-sslcert"   #    data     = var.certificateexamplecom_filebase64   #    password = var.certificateexamplecom_password   #  }]
ssl_policy = {     policy_type = "Predefined"     policy_name = "AppGwSslPolicy20170401S"   }
rewriterulesets = [{     name = "${local.base_name}-example-rewrite-rule-set"     rewrite_rules = [       {         name          = "${local.base_name}-example-rewrite-rule-response-header"         rule_sequence = 100         conditions = [           {             ignore_case = true             negate      = false             pattern     = "text/html(.*)"             variable    = "httprespContent-Type"           }         ]         responseheaderconfigurations = [{           header_name  = "X-Frame-Options"           header_value = "DENY"         }]       },       {         name          = "${local.base_name}-example-rewrite-rule-url"         rule_sequence = 100         conditions = [           {             ignore_case = false             negate      = false             pattern     = ".*-R[0-9]{10,10}\\.html"             variable    = "varuripath"           },           {             ignore_case = true             negate      = false             pattern     = ".*\\.fr"             variable    = "var_host"           }         ]         url_reroute = {           path         = "/fr{varuripath}"           query_string = null           reroute      = false         }       }     ]   }]
urlpathmaps = [     {       name                               = "${local.base_name}-example-url-path-map"       defaultbackendhttpsettingsname = "${local.base_name}-backhttpsettings-http"       defaultbackendaddresspoolname  = "${local.base_name}-backendpool"       defaultrewriterulesetname      = "${local.base_name}-example-rewrite-rule-set"       # defaultredirectconfigurationname = "${local.basename}-redirect"       path_rules = [         {           name                       = "${local.base_name}-example-url-path-rule"           backendaddresspoolname  = "${local.basename}-backendpool"           backendhttpsettingsname = "${local.basename}-backhttpsettings-http"           rewriterulesetname      = "${local.basename}-example-rewrite-rule-set"           paths                      = ["/demo/"]         }       ]     }   ]
autoscale_configuration = {     min_capacity = 2     max_capacity = 15   }
logsdestinationsids = [     # module.logs.id,     # module.logs.storageaccountid,   ] }

Providers

| Name | Version | | ---- | ------- | | azurecaf | >= 1.2.28 | | azurerm | ~> 4.31 | | terraform | n/a |

Modules

| Name | Source | Version | | ---- | ------ | ------- | | diagnostics | claranet/diagnostic-settings/azurerm | ~> 8.2.0 | | nsg | claranet/nsg/azurerm | ~> 8.1.0 | | subnet | claranet/subnet/azurerm | ~> 8.1.0 |

Resources

| Name | Type | | ---- | ---- | | azurermapplicationgateway.main | resource | | azurermpublicip.main | resource | | terraformdata.createsubnetcondition | resource | | azurecafname.appgw | data source | | azurecafname.frontipconfig | data source | | azurecafname.frontipconfig_priv | data source | | azurecafname.gwipconfig | data source | | azurecafname.nsg_appgw | data source | | azurecafname.nsr_healthcheck | data source | | azurecafname.nsr_https | data source | | azurecafname.pip_appgw | data source | | azurecafname.subnet_appgw | data source |

Inputs

| Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | app\gateway\tags | Application Gateway tags. | map(string) | {} | no | | authentication\certificates | List of objects with authentication certificates configurations.
The path to a base-64 encoded certificate is expected in the 'data' attribute:

data = filebase64("./filepath")

list(object({
    name = string
    data = string
  }))

object({
    mincapacity = number
    maxcapacity = optional(number, 5)
  })

list(object({
    name         = string
    fqdns        = optional(list(string))
    ip_addresses = optional(list(string))
  }))

list(object({
    name     = string
    port     = optional(number, 443)
    protocol = optional(string, "Https")

    path       = optional(string)
    probename = optional(string)

    cookiebasedaffinity               = optional(string, "Disabled")
    affinitycookiename                = optional(string, "ApplicationGatewayAffinity")
    requesttimeout                     = optional(number, 20)
    hostname                           = optional(string)
    pickhostnamefrombackendaddress = optional(bool, true)
    trustedrootcertificatenames      = optional(list(string), [])
    authenticationcertificate          = optional(string)

    connectiondrainingtimeout_sec = optional(number)
  }))

list(object({
    statuscode           = string
    customerrorpageurl = string
  }))

list(object({
    name = string
    port = number
  }))

object({
    privateipaddressallocation   = optional(string, "Static")
    privateipaddress              = optional(string)
    privatelinkconfiguration_name = optional(string)
  })

list(object({
    name = string

    frontendipconfigurationname = optional(string)
    frontendportname             = optional(string)
    hostname                      = optional(string)
    hostnames                     = optional(list(string))
    protocol                       = optional(string, "Https")
    requiresni                    = optional(bool, false)
    sslcertificatename           = optional(string)
    sslprofilename               = optional(string)
    firewallpolicyid             = optional(string)

    customerrorconfigurations = optional(list(object({
      statuscode           = string
      customerrorpage_url = string
    })), [])
  }))

list(object({
    name = string
    ipconfigurations = list(object({
      name      = string
      subnet_id = string
      primary   = optional(bool, true)
    }))
  }))

list(object({
    name     = string
    host     = optional(string)
    port     = optional(number, null)
    interval = optional(number, 30)
    path     = optional(string, "/")
    protocol = optional(string, "Https")
    timeout  = optional(number, 30)

    unhealthythreshold                       = optional(number, 3)
    pickhostnamefrombackendhttpsettings = optional(bool, false)
    minimumservers                           = optional(number, 0)

    match = optional(object({
      body        = optional(string, "")
      status_code = optional(list(string), ["200-399"])
    }), {})
  }))

object({
    enabled                 = optional(bool, true)
    existingid             = optional(string)
    ddosprotectionmode    = optional(string, "VirtualNetworkInherited")
    ddosprotectionplanid = optional(string)
    extratags              = optional(map(string), {})
  })

list(object({
    name = string

    redirecttype        = optional(string, "Permanent")
    targetlistenername = optional(string)
    targeturl           = optional(string)

    includepath         = optional(bool, true)
    includequerystring = optional(bool, true)
  }))

list(object({
    name                        = string
    ruletype                   = optional(string, "Basic")
    httplistenername          = optional(string)
    backendaddresspoolname   = optional(string)
    backendhttpsettingsname  = optional(string)
    urlpathmapname           = optional(string)
    redirectconfigurationname = optional(string)
    rewriteruleset_name       = optional(string)
    priority                    = optional(number)
  }))

list(object({
    name = string
    rewriterules = list(object({
      name          = string
      rulesequence = string

      conditions = optional(list(object({
        variable    = string
        pattern     = string
        ignorecase = optional(bool, false)
        negate      = optional(bool, false)
      })), [])

      responseheaderconfigurations = optional(list(object({
        headername  = string
        headervalue = string
      })), [])

      requestheaderconfigurations = optional(list(object({
        headername  = string
        headervalue = string
      })), [])

      urlreroute = optional(object({
        path         = optional(string)
        query_string = optional(string)
        components   = optional(string)
        reroute      = optional(bool)
      }))
    }))
  }))

data = filebase64("./filepath")

list(object({
    name                = string
    data                = optional(string)
    password            = optional(string)
    keyvaultsecret_id = optional(string)
  }))

object({
    disabledprotocols   = optional(list(string), [])
    policytype          = optional(string, "Predefined")
    policyname          = optional(string, "AppGwSslPolicy20170401S")
    ciphersuites        = optional(list(string), [])
    minprotocolversion = optional(string, "TLSv1_2")
  })

list(object({
    name                             = string
    trustedclientcertificatenames = optional(list(string), [])
    verifyclientcertissuerdn     = optional(bool, false)
    sslpolicy = optional(object({
      disabledprotocols   = optional(list(string), [])
      policytype          = optional(string, "Predefined")
      policyname          = optional(string, "AppGwSslPolicy20170401S")
      ciphersuites        = optional(list(string), [])
      minprotocolversion = optional(string, "TLSv12")
    }))
  }))

[
  "Microsoft.KeyVault"
]

data = filebase64("./file_path")

list(object({
    name = string
    data = string
  }))

list(object({
    name                = string
    data                = optional(string)
    filepath           = optional(string)
    keyvaultsecret_id = optional(string)
  }))

list(object({
    name = string

    defaultbackendaddresspoolname   = optional(string)
    defaultredirectconfigurationname = optional(string)
    defaultbackendhttpsettingsname  = optional(string)
    defaultrewriterulesetname       = optional(string)

    pathrules = list(object({
      name = string

      backendaddresspoolname   = optional(string)
      backendhttpsettingsname  = optional(string)
      rewriterulesetname       = optional(string)
      redirectconfigurationname = optional(string)
      firewallpolicy_id          = optional(string)

      paths = optional(list(string), [])
    }))
  }))

[
  1,
  2,
  3
]