Feat(Terraform): front door

terraform/app_service.tf

@@ -22,13 +22,25 @@ resource "azurerm_linux_web_app" "main" {
     ftps_state    = "Disabled"
     http2_enabled = true
 
-    dynamic "ip_restriction" {
-      for_each = var.IP_ADDRESS_WHITELIST
-      content {
-        ip_address = ip_restriction.value
+    vnet_route_all_enabled = true
+
+    ip_restriction {
+      name        = "Front Door"
+      priority    = 100
+      action      = "Allow"
+      service_tag = "AzureFrontDoor.Backend"
+      headers {
+        x_azure_fdid = [azurerm_cdn_frontdoor_profile.main.resource_guid]
       }
     }
-    vnet_route_all_enabled = true
+
+    ip_restriction {
+      name        = "Availability Test"
+      priority    = 200
+      action      = "Allow"
+      service_tag = "ApplicationInsightsAvailability"
+    }
+
     application_stack {
       docker_image     = "ghcr.io/cal-itp/eligibility-server"
       docker_image_tag = local.env_name

terraform/environment.tf

@@ -1,5 +1,6 @@
 locals {
   is_prod  = terraform.workspace == "default"
+  is_test  = terraform.workspace == "test"
   env_name = local.is_prod ? "prod" : terraform.workspace
 }
 

terraform/front_door.tf

@@ -0,0 +1,92 @@
+locals {
+  front_door_name = "eligibility-server-${local.env_name}"
+}
+
+resource "azurerm_cdn_frontdoor_profile" "main" {
+  name                = local.front_door_name
+  resource_group_name = data.azurerm_resource_group.main.name
+  sku_name            = "Standard_AzureFrontDoor"
+}
+
+resource "azurerm_cdn_frontdoor_endpoint" "main" {
+  # used in the front door URL
+  name                     = "mst-courtesy-cards-eligibility-server-${local.env_name}"
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
+}
+
+resource "azurerm_cdn_frontdoor_origin_group" "main" {
+  name                     = local.front_door_name
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
+  session_affinity_enabled = true
+
+  load_balancing {}
+}
+
+resource "azurerm_cdn_frontdoor_origin" "main" {
+  name                          = local.front_door_name
+  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.main.id
+
+  enabled                        = true
+  host_name                      = azurerm_linux_web_app.main.default_hostname
+  http_port                      = 80
+  https_port                     = 443
+  origin_host_header             = azurerm_linux_web_app.main.default_hostname
+  certificate_name_check_enabled = true
+  priority                       = 1
+  weight                         = 1000
+}
+
+resource "azurerm_cdn_frontdoor_route" "main" {
+  name                          = local.front_door_name
+  cdn_frontdoor_endpoint_id     = azurerm_cdn_frontdoor_endpoint.main.id
+  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.main.id
+  cdn_frontdoor_origin_ids      = [azurerm_cdn_frontdoor_origin.main.id]
+
+  https_redirect_enabled = true
+  supported_protocols    = ["Http", "Https"]
+  patterns_to_match      = ["/*"]
+  forwarding_protocol    = "HttpsOnly"
+  link_to_default_domain = true
+}
+
+resource "azurerm_cdn_frontdoor_security_policy" "main" {
+  name                     = local.front_door_name
+  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
+
+  security_policies {
+    firewall {
+      cdn_frontdoor_firewall_policy_id = azurerm_cdn_frontdoor_firewall_policy.main.id
+      association {
+        patterns_to_match = ["/*"]
+        domain {
+          cdn_frontdoor_domain_id = azurerm_cdn_frontdoor_endpoint.main.host_name
+        }
+      }
+    }
+  }
+}
+
+resource "azurerm_cdn_frontdoor_firewall_policy" "main" {
+  name                              = "${local.env_name}waf"
+  resource_group_name               = data.azurerm_resource_group.main.name
+  sku_name                          = azurerm_cdn_frontdoor_profile.main.sku_name
+  enabled                           = true
+  mode                              = "Prevention"
+  custom_block_response_status_code = 403
+  custom_block_response_body        = base64encode("Blocked")
+
+  custom_rule {
+    name     = "iprestriction${local.env_name}"
+    enabled  = true
+    type     = "MatchRule"
+    priority = 1
+    action   = "Block"
+
+    match_condition {
+      match_variable     = "SocketAddr"
+      operator           = "Contains"
+      negation_condition = true
+      match_values       = local.is_prod ? var.IP_ADDRESS_WHITELIST_PROD : local.is_test ? var.IP_ADDRESS_WHITELIST_TEST : var.IP_ADDRESS_WHITELIST_DEV
+    }
+  }
+}

terraform/variables.tf

@@ -16,7 +16,19 @@ variable "VELOCITY_ETL_APP_OBJECT_ID" {
   type        = string
 }
 
-variable "IP_ADDRESS_WHITELIST" {
+variable "IP_ADDRESS_WHITELIST_DEV" {
+  description = "List of IP addresses allowed to connect to the app service, in CIDR notation: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#ip_address. By default, all IP addresses are allowed."
+  type        = list(string)
+  default     = []
+}
+
+variable "IP_ADDRESS_WHITELIST_TEST" {
+  description = "List of IP addresses allowed to connect to the app service, in CIDR notation: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#ip_address. By default, all IP addresses are allowed."
+  type        = list(string)
+  default     = []
+}
+
+variable "IP_ADDRESS_WHITELIST_PROD" {
   description = "List of IP addresses allowed to connect to the app service, in CIDR notation: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_web_app#ip_address. By default, all IP addresses are allowed."
   type        = list(string)
   default     = []