Key Takeaways

• Use azurerm_cdn_frontdoor_endpoint to create a globally distributed, high‑performance CDN endpoint.
• Front Door offers dynamic site acceleration, SSL termination, WAF, and custom domain support out of the box.
• Follow the step‑by‑step checklist to configure routing, caching, security, and monitoring.
• Leverage the comparison table to decide when Front Door is preferable over Azure CDN Standard.
• Set up Azure Monitor, Log Analytics, and alerts to maintain uptime and performance.

1. Intro to Azure Front Door and the azurerm_cdn_frontdoor_endpoint Resource

Azure Front Door is a global, scalable entry point that combines global load balancing, edge caching, and web application firewall. The azurerm_cdn_frontdoor_endpoint Terraform resource provisions an endpoint that delivers your content from the nearest edge location.

Typical use cases include:

• Static site hosting (HTML, CSS, JS, images)
• Dynamic API acceleration
• Global SaaS applications with low latency requirements
• Secure content delivery with TLS/SSL and custom domain mapping

2. Step‑by‑Step Playbook

2.1 Prerequisites

• Azure subscription with Front Door Standard/Premium SKU activated.
• Terraform CLI 1.8+ and Azure Provider 3.0+.
• Valid TLS certificate or Azure Key Vault secret for custom domains.
• Azure CLI or PowerShell for quick checks.

2.2 Create a Resource Group and Front Door

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "rg" {
  name     = "rg-cdn-demo"
  location = "eastus"
}

resource "azurerm_cdn_frontdoor_profile" "fd" {
  name                = "fd-demo-profile"
  resource_group_name = azurerm_resource_group.rg.name
  sku_name            = "Standard_AzureFrontDoor"
  location            = "global"
}

2.3 Define the Endpoint

resource "azurerm_cdn_frontdoor_endpoint" "endpoint" {
  name                = "frontend-demo"
  profile_name        = azurerm_cdn_frontdoor_profile.fd.name
  resource_group_name = azurerm_resource_group.rg.name
  enabled             = true
}

2.4 Add Backends & Routing Rules

• Backends: your origin servers (storage, App Service, API Management).
• Routing rules: path patterns, cache settings, custom error pages.
• Use azurerm_cdn_frontdoor_origin_group and azurerm_cdn_frontdoor_origin resources.

2.5 Configure Custom Domains and SSL

• Upload certificate to Key Vault or use Azure Managed Certificates.
• Map custom domain with azurerm_cdn_frontdoor_custom_domain.
• Set ssl_certificate_type = "ManagedCertificate" for free TLS.

2.6 Enable WAF and Rate Limiting

• Create a WAF policy with azurerm_frontdoor_firewall_policy.
• Associate the policy to the Front Door profile.
• Configure rate limiting, bot protection, and geo‑restriction rules.

2.7 Monitoring & Logging

• Enable Diagnostic Settings to send logs to Log Analytics, Event Hub, or Storage.
• Configure Azure Monitor alerts for latency, error rates, and TLS failures.
• Use azurerm_cdn_frontdoor_endpoint_monitoring_settings for health probes.

2.8 Deployment Checklist

• ✅ azurerm_cdn_frontdoor_profile exists.
• ✅ Endpoint is enabled.
• ✅ Backends are healthy (probe status 200).
• ✅ Routing rules match URL patterns.
• ✅ Custom domain mapped and SSL verified.
• ✅ WAF policy applied.
• ✅ Diagnostic logging enabled.
• ✅ Alerts configured.

3. Comparison: Azure Front Door vs. Azure CDN Standard

4. FAQ

Q1: Can I use azurerm_cdn_frontdoor_endpoint with an existing Azure Front Door profile?

Yes. The endpoint resource only requires the profile name and resource group. You can add or remove endpoints on an existing profile without redeploying the entire Front Door.

Q2: How do I handle custom error pages on Front Door?

Use the custom_error_response_settings block within the azurerm_cdn_frontdoor_route resource. Point the