Azure App Service Web (Linux or Windows)

This Terraform module creates an Azure Service Plan using our dedicated Terraform module and creates an Azure App Service Web (Linux or Windows) associated with an Application Insights component and activated Diagnostics Logs.

Limitations

• Diagnostics logs only works fine for Windows for now.
• Untested with App Service slots.
• Using a single certificate file on multiple domains with the custom_domains variable is not supported. Use a Key Vault certificate instead.

Global versioning rule for Claranet Azure modules

Module version	Terraform version	OpenTofu version	AzureRM version
>= 8.x.x	Unverified	1.8.x	>= 4.0
>= 7.x.x	1.3.x		>= 3.0
>= 6.x.x	1.x		>= 3.0
>= 5.x.x	0.15.x		>= 2.0
>= 4.x.x	0.13.x / 0.14.x		>= 2.0
>= 3.x.x	0.12.x		>= 2.0
>= 2.x.x	0.12.x		< 2.0
< 2.x.x	0.11.x		< 2.0

Contributing

If you want to contribute to this repository, feel free to use our pre-commit git hook configuration which will help you automatically update and format some files for you by enforcing our Terraform code module best-practices.

More details are available in the CONTRIBUTING.md file.

Usage

This module is optimized to work with the Claranet terraform-wrapper tool which set some terraform variables in the environment needed by this module. More details about variables set by the terraform-wrapper available in the documentation.

⚠️ Since modules version v8.0.0, we do not maintain/check anymore the compatibility with Hashicorp Terraform. Instead, we recommend to use OpenTofu.

resource "azurerm_storage_account" "assets_storage" {
  account_replication_type = "LRS"
  account_tier             = "Standard"
  location                 = module.azure_region.location
  name                     = "appserviceassets"
  resource_group_name      = module.rg.name
  min_tls_version          = "TLS1_2"
}

resource "azurerm_storage_share" "assets_share" {
  name               = "assets"
  storage_account_id = azurerm_storage_account.assets_storage.id
  quota              = 50
}

module "app_service" {
  source  = "claranet/app-service/azurerm"
  version = "x.x.x"

  client_name         = var.client_name
  environment         = var.environment
  location            = module.azure_region.location
  location_short      = module.azure_region.location_short
  resource_group_name = module.rg.name
  stack               = var.stack

  os_type  = "Linux"
  sku_name = "B2"

  app_settings = {
    FOO = "bar"
  }

  site_config = {
    application_stack = {
      php_version = "8.2"
    }

    http2_enabled = true

    ip_restriction_default_action     = "Deny"
    scm_ip_restriction_default_action = "Deny"
  }

  auth_settings = {
    enabled             = true
    token_store_enabled = true

    active_directory = {
      client_id         = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      client_secret     = "xxxxxxxxxxxxxxxxxxxxx"
      allowed_audiences = ["https://www.example.com"]
    }
  }

  custom_domains = {
    # Custom domain with SSL certificate file
    "example.com" = {
      certificate_file     = "./example.com.pfx"
      certificate_password = "xxxxxxxxx"
    }
    # Custom domain with SSL certificate stored in a keyvault
    "example2.com" = {
      certificate_keyvault_certificate_id = var.certificate_keyvault_id
    }
    # Custom domain without SSL certificate
    "example3.com" = null
    # Custom domain with an existant SSL certificate
    "exemple4.com" = {
      certificate_id = var.certificate_id
    }
  }

  allowed_cidrs = ["1.2.3.4/32", "4.3.2.1/32"]

  ip_restriction_headers = {
    x_forwarded_host = ["myhost1.fr", "myhost2.fr"]
  }
  scm_ip_restriction_headers = {
    x_forwarded_host = ["myhost1.fr", "myhost2.fr"]
  }

  staging_slot_custom_app_settings = {
    John = "Doe"
  }

  extra_tags = {
    foo = "bar"
  }

  mount_points = [
    {
      account_name = azurerm_storage_account.assets_storage.name
      share_name   = azurerm_storage_share.assets_share.name
      access_key   = azurerm_storage_account.assets_storage.primary_access_key
      mount_path   = "/var/www/html/assets"
    }
  ]

  logs_destinations_ids = [
    module.run.logs_storage_account_id,
    module.run.log_analytics_workspace_id,
  ]
}

Providers

Name	Version
null	~> 3.0

Modules

Name	Source	Version
container_web_app	./modules/container-web-app	n/a
linux_web_app	./modules/linux-web-app	n/a
service_plan	claranet/app-service-plan/azurerm	~> 8.0.0
windows_web_app	./modules/windows-web-app	n/a

Resources

Name	Type
null_resource.fake_webapp_container_condition	resource

Inputs

Name	Description	Type	Default	Required
allowed_cidrs	IPs restriction for App Service. See documentation.	list(string)	[]	no
allowed_service_tags	Service Tags restriction for App Service. See documentation.	list(string)	[]	no
allowed_subnet_ids	Subnets restriction for App Service. See documentation.	list(string)	[]	no
app_service_custom_name	Name of the App Service, generated if not set.	string	""	no
app_service_environment_id	The ID of the App Service Environment to create this Service Plan in. Requires an Isolated SKU. Use one of I1, I2, I3 for azurerm_app_service_environment, or I1v2, I2v2, I3v2 for azurerm_app_service_environment_v3.	string	null	no
app_settings	Application settings for App Service. See documentation.	map(string)	{}	no
application_insights	Application Insights parameters.	object({ enabled = optional(bool, true) id = optional(string, null) custom_name = optional(string, null) type = optional(string, "web") daily_data_cap = optional(number, null) daily_data_cap_notifications_disabled = optional(bool, null) retention = optional(number, 90) internet_ingestion_enabled = optional(bool, true) internet_query_enabled = optional(bool, true) ip_masking_disabled = optional(bool, false) local_authentication_disabled = optional(bool, false) force_customer_storage_for_profiler = optional(bool, false) log_analytics_workspace_id = optional(string, null) sampling_percentage = optional(number, null) })	{}	no
auth_settings	Authentication settings. Issuer URL is generated thanks to the tenant ID. For active_directory block, the allowed_audiences list is filled with a value generated with the name of the App Service. See documentation.	any	{}	no
auth_settings_v2	Authentication settings V2. See documentation.	any	{}	no
backup_custom_name	Custom name for backup.	string	null	no
backup_enabled	true to enable App Service backup.	bool	false	no
backup_frequency_interval	Frequency interval for the App Service backup.	number	1	no
backup_frequency_unit	Frequency unit for the App Service backup. Possible values are Day or Hour.	string	"Day"	no
backup_keep_at_least_one_backup	Should the service keep at least one backup, regardless of age of backup.	bool	true	no
backup_retention_period_in_days	Retention in days for the App Service backup.	number	30	no
backup_storage_account_connection_string	Storage account connection string to use if App Service backup is enabled.	string	null	no
backup_storage_account_container	Name of the container in the Storage Account if App Service backup is enabled.	string	"webapps"	no
certificates	Certificates for custom domains	map(map(string))	{}	no
client_affinity_enabled	Client affinity activation for App Service. See documentation.	bool	false	no
client_certificate_enabled	Client certificate activation for App Service. See documentation.	bool	false	no
client_name	Client name/account used in naming.	string	n/a	yes
connection_strings	Connection strings for App Service. See documentation.	list(map(string))	[]	no
custom_domains	Custom domains and SSL certificates of the App Service. Could declare a custom domain with SSL binding. SSL certificate could be provided from an Azure Keyvault Certificate Secret or from a file with following attributes : - certificate_name: Name of the stored certificate. - certificate_keyvault_certificate_id: ID of the Azure Keyvault Certificate Secret.	map(object({ certificate_name = optional(string) certificate_keyvault_certificate_id = optional(string) certificate_thumbprint = optional(string) }))	{}	no
default_tags_enabled	Option to enable or disable default tags.	bool	true	no
diagnostic_settings_custom_name	Custom name of the diagnostics settings, name will be 'default' if not set.	string	"default"	no
docker_image	Docker image to use for this App Service.	object({ registry = optional(string) name = string tag = string registry_username = optional(string) registry_password = optional(string) slot_name = optional(string) slot_tag = optional(string) })	null	no
environment	Project environment.	string	n/a	yes
extra_tags	Extra tags to add.	map(string)	{}	no
https_only	HTTPS restriction for App Service. See documentation.	bool	true	no
identity	Map with identity block information.	object({ type = string identity_ids = list(string) })	{ "identity_ids": [], "type": "SystemAssigned" }	no
ip_restriction_headers	IPs restriction headers for App Service. See documentation.	map(list(string))	null	no
location	Azure location.	string	n/a	yes
location_short	Short string for Azure location.	string	n/a	yes
logs	Configuration of the App Service and App Service slot logs. See documentation.	object({ detailed_error_messages = optional(bool) failed_request_tracing = optional(bool) application_logs = optional(object({ file_system_level = string azure_blob_storage = optional(object({ level = string retention_in_days = number sas_url = string })) })) http_logs = optional(object({ azure_blob_storage = optional(object({ retention_in_days = number sas_url = string })) file_system = optional(object({ retention_in_days = number retention_in_mb = number })) })) })	null	no
logs_categories	Log categories to send to destinations.	list(string)	null	no
logs_destinations_ids	List of destination resources IDs for logs diagnostic destination. Can be Storage Account, Log Analytics Workspace and Event Hub. No more than one of each can be set. If you want to use Azure EventHub as a destination, you must provide a formatted string containing both the EventHub Namespace authorization send ID and the EventHub name (name of the queue to use in the Namespace) separated by the | character.	list(string)	n/a	yes
logs_metrics_categories	Metrics categories to send to destinations.	list(string)	null	no
maximum_elastic_worker_count	The maximum number of workers to use in an Elastic SKU Plan. Cannot be set unless using an Elastic SKU.	number	null	no
mount_points	Storage Account mount points. Name is generated if not set and default type is AzureFiles. See documentation.	list(object({ name = optional(string) type = optional(string, "AzureFiles") account_name = string share_name = string access_key = string mount_path = optional(string) }))	[]	no
name_prefix	Optional prefix for the generated name.	string	""	no
name_suffix	Optional suffix for the generated name.	string	""	no
os_type	The O/S type for the App Services to be hosted in this plan. Possible values include Windows, Linux, and WindowsContainer.	string	n/a	yes
per_site_scaling_enabled	Should Per Site Scaling be enabled.	bool	false	no
public_network_access_enabled	Whether enable public access for the App Service.	bool	false	no
resource_group_name	Resource group name.	string	n/a	yes
scm_allowed_cidrs	SCM IPs restriction for App Service. See documentation.	list(string)	[]	no
scm_allowed_service_tags	SCM Service Tags restriction for App Service. See documentation.	list(string)	[]	no
scm_allowed_subnet_ids	SCM subnets restriction for App Service. See documentation.	list(string)	[]	no
scm_ip_restriction_headers	IPs restriction headers for App Service. See documentation.	map(list(string))	null	no
service_plan_custom_name	Name of the App Service Plan, generated if not set.	string	""	no
service_plan_extra_tags	Extra tags to add.	map(string)	{}	no
site_config	Site config for App Service. See documentation. IP restriction attribute is no more managed in this block.	any	{}	no
sku_name	The SKU for the plan. Possible values include B1, B2, B3, D1, F1, FREE, I1, I2, I3, I1v2, I2v2, I3v2, P1v2, P2v2, P3v2, P0v3, P1v3, P2v3, P3v3, S1, S2, S3, SHARED, Y1, EP1, EP2, EP3, WS1, WS2, and WS3.	string	n/a	yes
stack	Project stack name.	string	n/a	yes
staging_slot_custom_app_settings	Override staging slot with custom app settings.	map(string)	null	no
staging_slot_custom_name	Custom name of the app service slot.	string	null	no
staging_slot_enabled	Create a staging slot alongside the App Service for blue/green deployment purposes. See documentation.	bool	true	no
staging_slot_mount_points	Storage Account mount points for staging slot. Name is generated if not set and default type is AzureFiles. See documentation.	list(object({ name = optional(string) type = optional(string, "AzureFiles") account_name = string share_name = string access_key = string mount_path = optional(string) }))	[]	no
staging_slot_site_config	Staging slot site config for App Service. See documentation.	any	{}	no
sticky_settings	Lists of connection strings and app settings to prevent from swapping between slots.	object({ app_setting_names = optional(list(string)) connection_string_names = optional(list(string)) })	null	no
vnet_integration_subnet_id	ID of the subnet to associate with the App Service.	string	null	no
worker_count	The number of Workers (instances) to be allocated.	number	3	no
zone_balancing_enabled	Should the Service Plan balance across Availability Zones in the region.	bool	true	no

Outputs

Name	Description
module_container	App Service Container (Container WebApp) output object if Container is choosen. Please refer to ./modules/container-web-app/README.md
module_linux	App Service Linux (Linux WebApp) output object if Linux is choosen. Please refer to ./modules/linux-web-app/README.md
module_service_plan	Service Plan output object. Please refer to module documentation.
module_windows	App Service Windows (Windows WebApp) output object if Windows is choosen. Please refer to ./modules/windows-web-app/README.md

Related documentation

Microsoft Azure documentation: docs.microsoft.com/en-us/azure/app-service/overview