Introduction
Azure Front Door is a global traffic management service that combines load balancing, acceleration, and security. In 2026, businesses demand resilient architectures against regional outages. This tutorial guides you step-by-step through an advanced configuration including dynamic routing rules, WAF policies, and Terraform integration. You'll get a system capable of handling millions of requests with minimal latency.
Prerequisites
- Azure account with Contributor rights
- Terraform 1.7+
- Azure CLI installed and authenticated
- Solid knowledge of networking and security
Initialize the Terraform Provider
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "~> 4.0"
}
}
}
provider "azurerm" {
features {}
}This file configures the official Azure provider. Always use a locked version to guarantee reproducibility of production deployments.
Create the Front Door Profile
resource "azurerm_cdn_frontdoor_profile" "main" {
name = "fd-advanced-prod"
resource_group_name = azurerm_resource_group.main.name
sku_name = "Premium_AzureFrontDoor"
tags = {
Environment = "Production"
Year = "2026"
}
}The Premium SKU enables advanced features such as managed WAF and complex routing rules. This profile acts as a logical container for all endpoints.
Configure Endpoints and Backends
resource "azurerm_cdn_frontdoor_endpoint" "main" {
name = "fd-endpoint-prod"
cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
}
resource "azurerm_cdn_frontdoor_origin_group" "backend" {
name = "origin-group-main"
cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
load_balancing {
sample_size = 4
successful_samples_required = 3
}
}The origin group defines load balancing logic and health probes. Adjust sample_size for finer balancing in high-load environments.
Advanced Routing Rules
resource "azurerm_cdn_frontdoor_route" "api" {
name = "route-api-v2"
cdn_frontdoor_endpoint_id = azurerm_cdn_frontdoor_endpoint.main.id
cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.backend.id
supported_protocols = ["Https"]
patterns_to_match = ["/api/v2/*"]
forwarding_protocol = "HttpsOnly"
https_redirect_enabled = true
}This route directs API traffic to the correct backend with forced HTTPS redirection. The patterns_to_match enable highly granular routing.
Managed WAF Policy
resource "azurerm_cdn_frontdoor_firewall_policy" "main" {
name = "waf-policy-prod"
resource_group_name = azurerm_resource_group.main.name
sku_name = "Premium_AzureFrontDoor"
managed_rule_set {
type = "Microsoft_DefaultRuleSet"
version = "2.1"
}
}The Microsoft_DefaultRuleSet 2.1 protects against common OWASP attacks. Always enable it in Prevention mode for production.
Best Practices
- Always lock Terraform versions and SKUs
- Enable health probes with a 30-second interval
- Use managed identities for authentication
- Test routing rules in simulation mode before activation
- Monitor metrics via Azure Monitor and Log Analytics
Common Errors to Avoid
- Forgetting to enable HTTPS redirect on routes
- Configuring overly aggressive health probes that trigger false positives
- Ignoring custom WAF rule limits
- Not versioning Terraform files
Go Further
Deepen your skills with our advanced Azure training.