### Terraform Registry Module Source Example

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/AGENTS.md

Example of how to reference an AVM module from the Terraform Registry. Replace placeholders with actual module names and versions.

```terraform
source = "https://registry.terraform.io/modules/Azure/{module}/azurerm/latest"
```

--------------------------------

### Example Role Assignment Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Demonstrates how to configure role assignments for a CDN/Front Door profile. Ensure `skip_service_principal_aad_check` is only set to true when assigning roles to a service principal.

```terraform
role_assignments = {
  role_assignment_2 = {
    role_definition_id_or_name       = "Reader"
    principal_id                     = data.azurerm_client_config.current.object_id #"125****-c***-4f**-**0d-******53b5**"
    description                      = "Example role assignment 2 of reader role"
    skip_service_principal_aad_check = false
    principal_type                   = "ServicePrincipal"
    condition                        = "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container'"
    condition_version                = "2.0"
  }
}
```

--------------------------------

### GitHub Module Source Example

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/AGENTS.md

Example of how to reference an AVM module directly from GitHub. This is useful for development or when using unreleased versions.

```terraform
source = "https://github.com/Azure/terraform-azurerm-avm-{type}-{service}-{resource}"
```

--------------------------------

### Terraform Versions API Example

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/AGENTS.md

Example URL to query the Terraform Registry API for module versions. This can be used for programmatic inspection of available module versions.

```terraform
source = "https://registry.terraform.io/v1/modules/Azure/{module}/versions"
```

--------------------------------

### Configure Front Door Firewall Policy

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

This example demonstrates the basic configuration of a Front Door Firewall Policy, including SKU, enabled status, mode, and custom block responses. Ensure the SKU name for WAF is similar to the SKU name for the Front Door profile.

```terraform
front_door_firewall_policies = {
    fd_waf1_key = {
    name                              = "examplecdnfdwafpolicy1"
    resource_group_name               = azurerm_resource_group.this.name
    sku_name                          = "Premium_AzureFrontDoor" # Ensure SKU_name for WAF is similar to SKU_name for front door profile.
    enabled                           = true
    mode                              = "Prevention"
    redirect_url                      = "https://www.contoso.com"
    custom_block_response_status_code = 405
    custom_block_response_body        = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="

      custom_rules = {
        cr1 = {
          name                           = "Rule1"
          enabled                        = true
          priority                       = 1
          rate_limit_duration_in_minutes = 1
          rate_limit_threshold           = 10
          type                           = "MatchRule"
          action                         = "Block"
          match_conditions = {
            m1 = {
              match_variable     = "RemoteAddr"
              operator           = "IPMatch"
              negation_condition = false
              match_values       = ["10.0.1.0/24", "10.0.0.0/24"]
            }
          }
        }

        cr2 = {
          name                           = "Rule2"
          enabled                        = true
          priority                       = 2
          rate_limit_duration_in_minutes = 1
          rate_limit_threshold           = 10
          type                           = "MatchRule"
          action                         = "Block"
          match_conditions = {
            match_condition1 = {
              match_variable     = "RemoteAddr"
              operator           = "IPMatch"
              negation_condition = false
              match_values       = ["192.168.1.0/24"]
            }

            match_condition2 = {
              match_variable     = "RequestHeader"
              selector           = "UserAgent"
              operator           = "Contains"
              negation_condition = false
              match_values       = ["windows"]
              transforms         = ["Lowercase", "Trim"]
            }
          }
        }
      }
      managed_rules = {
        mr1 = {
          type    = "Microsoft_DefaultRuleSet"
          version = "2.1"
          action  = "Log"
          exclusions = {
            exclusion1 = {
              match_variable = "QueryStringArgNames"
              operator       = "Equals"
              selector       = "not_suspicious"
            }
          }

```

--------------------------------

### Internal Load Balancer Setup

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_service_to_LB/README.md

Configures a Standard SKU internal load balancer with a static IPv4 frontend IP address within the specified subnet and zones.

```hcl
# Create an Internal Load balancer resource
resource "azurerm_lb" "lb" {
  location            = azurerm_resource_group.this.location
  name                = "lb-example"
  resource_group_name = azurerm_resource_group.this.name
  sku                 = "Standard"

  frontend_ip_configuration {
    name                          = "afd-lb-ip"
    private_ip_address            = "10.5.1.4"
    private_ip_address_allocation = "Static"
    private_ip_address_version    = "IPv4"
    subnet_id                     = azurerm_subnet.subnet.id
    zones                         = ["1", "2", "3"]
  }
}
```

--------------------------------

### Terraform Configuration and Provider Setup

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/cdn_default_microsoft_with_custom_domain/README.md

Sets up the required Terraform version, providers (azurerm), and the azurerm provider configuration. Ensure to replace 'your-subscription-id' with your actual Azure subscription ID if uncommenting.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {}
  # subscription_id = "your-subscription-id" # Replace with your Azure subscription ID
}
```

--------------------------------

### Configure Front Door Origins

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Example of how to define Front Door origins, including essential details like name, origin group, host name, and certificate name check. It also demonstrates the configuration of private link settings for secure connections.

```terraform
front_door_origins = {
    origin1_key = {
      name                           = "origin1"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = true
      host_name                      = replace(replace(azurerm_storage_account.storage.primary_blob_endpoint, "https://", ""), "/", "")
      http_port                      = 80
      https_port                     = 443
      host_header                    = replace(replace(azurerm_storage_account.storage.primary_blob_endpoint, "https://", ""), "/", "")
      priority                       = 1
      weight                         = 1
      private_link = {
        pl = {
          request_message        = "Please approve this private link connection"
          target_type            = "blob"
          location               = azurerm_storage_account.storage.location
          private_link_target_id = azurerm_storage_account.storage.id
        }
      }
    }
  }
```

--------------------------------

### Configure CDN Profile Rules with Actions

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Example of defining CDN rules with various actions including URL rewrite, route configuration override, and response header modifications. Ensure correct behavior and caching settings are applied.

```terraform
front_door_rules = {
  rule1_key = {
    name              = "examplerule1"
    order             = 1
    behavior_on_match = "Continue"
    rule_set_name     = "ruleset1"
    origin_group_key  = "og1_key"
    actions = {

      url_rewrite_actions = [{
        source_pattern          = "/"
        destination             = "/index3.html"
        preserve_unmatched_path = false
      }]
      route_configuration_override_actions = [{
        set_origin_groupid            = true
        forwarding_protocol           = "HttpsOnly"
        query_string_caching_behavior = "IncludeSpecifiedQueryStrings"
        query_string_parameters       = ["foo", "clientIp={client_ip}"]
        compression_enabled           = true
        cache_behavior                = "OverrideIfOriginMissing"
        cache_duration                = "365.23:59:59"
      }]
      response_header_actions = [{
        header_action = "Append"
        header_name   = "headername"
        value         = "/abc"
      }]
    }
  }
}
```

--------------------------------

### Front Door Secrets Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Example input for managing Front Door (standard/premium) secrets. Requires a name for the secret and the resource ID of the Key Vault certificate.

```terraform
front_door_secrets = {
    secret1_key = {
      name                     = "Front-door-certificate"
      key_vault_certificate_id = azurerm_key_vault_certificate.keyvaultcert.versionless_id
    }
  }
```

--------------------------------

### Configure Diagnostic Settings for CDN Profile

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Example of configuring diagnostic settings for a CDN profile, including sending logs and metrics to a Log Analytics workspace and storage account, or to an Event Hub. Ensure log_groups is explicitly set if not using the default 'allLogs'.

```terraform
diagnostic_settings = {
  workspaceandstorage_diag = {
    name                           = "workspaceandstorage_diag"
    metric_categories              = ["AllMetrics"]
    log_categories                 = ["FrontDoorAccessLog", "FrontDoorHealthProbeLog", "FrontDoorWebApplicationFirewallLog"]
    log_groups                     = [] #must explicitly set since log_groups defaults to ["allLogs"]
    log_analytics_destination_type = "Dedicated"
    workspace_resource_id          = azurerm_log_analytics_workspace.workspace.id
    storage_account_resource_id    = azurerm_storage_account.storage.id
    #marketplace_partner_resource_id          = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{partnerResourceProvider}/{partnerResourceType}/{partnerResourceName}"
  }
  eventhub_diag = {
    name                                     = "eventhubforwarding"
    log_groups                               = ["allLogs", "Audit"] # you can set either log_categories or log_groups.
    metric_categories                        = ["AllMetrics"]
    event_hub_authorization_rule_resource_id = azurerm_eventhub_namespace_authorization_rule.example.id
    event_hub_name                           = azurerm_eventhub_namespace.eventhub_namespace.name
  }
}
```

--------------------------------

### Register Feature for Custom Domain Deletion

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

CLI commands to register a feature that bypasses the CNAME check for custom domain deletion during 'terraform destroy'. This is a one-time setup per subscription.

```bash
az feature register --namespace Microsoft.Cdn --name BypassCnameCheckForCustomDomainDeletion
```

```bash
az feature list -o table --query "[?contains(name, 'Microsoft.Cdn/BypassCnameCheckForCustomDomainDeletion')].{Name:name,State:properties.state}"
```

```bash
az provider register --namespace Microsoft.Cdn
```

--------------------------------

### Configure Azure CDN Front Door Profile

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_custom_domain_with_customer_managed_secret/README.md

This snippet demonstrates the basic configuration of an Azure CDN Front Door profile using the provided Terraform module. It includes essential parameters like location, name, resource group, and telemetry settings.

```terraform
module "azurerm_cdn_frontdoor_profile" {
  source = "../../"

  location            = azurerm_resource_group.this.location
  name                = module.naming.cdn_profile.name_unique
  resource_group_name = azurerm_resource_group.this.name
  enable_telemetry    = var.enable_telemetry
  front_door_endpoints = {
    ep1_key = {
      name = "ep1-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
  }
  front_door_origin_groups = {
    og1_key = {
      name = "og1"
      health_probe = {
        hp1 = {
          interval_in_seconds = 240
          path                = "/healthProbe"
          protocol            = "Https"
          request_type        = "HEAD"
        }
      }
      load_balancing = {
        lb1 = {
          additional_latency_in_milliseconds = 0
          sample_size                        = 16
          successful_samples_required        = 3
        }
      }
    }
  }
  front_door_origins = {
    origin1_key = {
      name                           = "origin1"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = false
      host_name                      = "contoso.com"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "www.contoso.com"
      priority                       = 1
      weight                         = 1
    }
    origin2_key = {
      name                           = "origin2"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = false
      host_name                      = "contoso1.com"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "www.contoso.com"
      priority                       = 1
      weight                         = 1
    }
    origin3_key = {
      name                           = "origin3"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = false
      host_name                      = "contoso1.com"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "www.contoso.com"
      priority                       = 1
      weight                         = 1
    }

  }
  front_door_routes = {
    route1_key = {
      name             = "route1"
      endpoint_key     = "ep1_key"
      origin_group_key = "og1_key"
      origin_keys      = ["example-origin", "origin3"]
      #custom_domain_keys     = ["contoso1_key"]  #Uncomment this line if you want to link custom domain with this route.
      forwarding_protocol    = "HttpsOnly"
      https_redirect_enabled = true
      patterns_to_match      = ["/*"]
      supported_protocols    = ["Http", "Https"]
      rule_set_names         = ["ruleset1"]
      cache = {
        cache1 = {
          query_string_caching_behavior = "IgnoreSpecifiedQueryStrings"
          query_strings                 = ["account", "settings"]
          compression_enabled           = true
          content_types_to_compress     = ["text/html", "text/javascript", "text/xml"]
        }
      }
    }
  }
  front_door_rule_sets = ["ruleset1", "ruleset2"]
  front_door_rules = {
    rule1_key = {
      name              = "examplerule1"
      order             = 1
      behavior_on_match = "Continue"
      rule_set_name     = "ruleset1"
      origin_group_key  = "og1_key"
      actions = {

        url_rewrite_actions = [{
          source_pattern          = "/"
          destination             = "/index3.html"
          preserve_unmatched_path = false
        }]
        route_configuration_override_actions = [{
          set_origin_groupid            = true
          forwarding_protocol           = "HttpsOnly"
          query_string_caching_behavior = "IncludeSpecifiedQueryStrings"
          query_string_parameters       = ["foo", "clientIp={client_ip}"]
          compression_enabled           = true
          cache_behavior                = "OverrideIfOriginMissing"
          cache_duration                = "365.23:59:59"
        }]
        response_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
        request_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
      }

      conditions = {
        remote_address_conditions = [{
          operator         = "IPMatch"
          negate_condition = false
          match_values     = ["10.0.0.0/23"]
        }]

        query_string_conditions = [{
          negate_condition = false
          operator         = "BeginsWith"
          match_values     = ["Query1", "Query2"]

```

--------------------------------

### CDN Endpoint Custom Domains Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Example input for configuring CDN Endpoint Custom Domains. This block defines custom domains associated with a CDN endpoint, including DNS zone details and HTTPS settings.

```terraform
cdn_endpoint_custom_domains = {
  cdn1 = {
    cdn_endpoint_key = "ep1"
    dns_zone = {
      is_azure_dns_zone                  = true
      name                               = data.azurerm_dns_zone.dns.name
      cname_record_name                  = "www"
      azure_dns_zone_resource_group_name = data.azurerm_dns_zone.dns.resource_group_name
    }
    name = "example-domain"
    cdn_managed_https = {
      certificate_type = "Dedicated"
      protocol_type    = "ServerNameIndication"
      tls_version      = "TLS12"
    }
  }
}
```

--------------------------------

### Configure Azure CDN Front Door Profile with WAF

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_security_policies/README.md

This snippet demonstrates how to configure an Azure CDN Front Door profile with custom domains, endpoints, and a Web Application Firewall (WAF) policy. Ensure the WAF SKU name matches the Front Door profile SKU name. For Standard SKU, managed rules are not supported.

```terraform
module "azurerm_cdn_frontdoor_profile" {
  source = "../../"

  location            = azurerm_resource_group.this.location
  name                = module.naming.cdn_profile.name_unique
  resource_group_name = azurerm_resource_group.this.name
  enable_telemetry    = var.enable_telemetry
  front_door_custom_domains = {
    cd1_key = {
      name        = "contoso1customdomain"
      dns_zone_id = azurerm_dns_zone.dnszone.id
      host_name   = "contoso1.fabrikam.com"

      tls = {
        certificate_type    = "ManagedCertificate"
        minimum_tls_version = "TLS12"
      }
    },
    cd2_key = {
      name        = "contoso2customdomain"
      dns_zone_id = azurerm_dns_zone.dnszone.id
      host_name   = "contoso2.fabrikam.com"
      tls = {
        certificate_type    = "ManagedCertificate"
        minimum_tls_version = "TLS12"
      }
    }
  }
  front_door_endpoints = {
    ep1_key = {
      name = "ep1-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
    ep2_key = {
      name = "ep2-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
    ep3_key = {
      name = "ep3-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
  }
  front_door_firewall_policies = {
    fd_waf1_key = {
      name                              = "examplecdnfdwafpolicy1"
      resource_group_name               = azurerm_resource_group.this.name
      sku_name                          = "Premium_AzureFrontDoor" # Ensure SKU_name for WAF is similar to SKU_name for front door profile. 
      enabled                           = true
      mode                              = "Prevention"
      redirect_url                      = "https://www.contoso.com"
      custom_block_response_status_code = 405
      custom_block_response_body        = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="

      custom_rules = {
        cr1 = {
          name                           = "Rule1"
          enabled                        = true
          priority                       = 1
          rate_limit_duration_in_minutes = 1
          rate_limit_threshold           = 10
          type                           = "MatchRule"
          action                         = "Block"
          match_conditions = {
            m1 = {
              match_variable     = "RemoteAddr"
              operator           = "IPMatch"
              negation_condition = false
              match_values       = ["10.0.1.0/24", "10.0.0.0/24"]
            }
          }
        }

        cr2 = {
          name                           = "Rule2"
          enabled                        = true
          priority                       = 2
          rate_limit_duration_in_minutes = 1
          rate_limit_threshold           = 10
          type                           = "MatchRule"
          action                         = "Block"
          match_conditions = {
            match_condition1 = {
              match_variable     = "RemoteAddr"
              operator           = "IPMatch"
              negation_condition = false
              match_values       = ["192.168.1.0/24"]
            }

            match_condition2 = {
              match_variable     = "RequestHeader"
              selector           = "UserAgent"
              operator           = "Contains"
              negation_condition = false
              match_values       = ["windows"]
              transforms         = ["Lowercase", "Trim"]
            }
          }
        }
      }

      # if using Standard sku , then managed rules are not supported, hence remove the below input variables
      managed_rules = {
        mr1 = {
          type    = "Microsoft_DefaultRuleSet"
          version = "2.1"
          action  = "Log"
          exclusions = {
            exclusion1 = {
              match_variable = "QueryStringArgNames"
              operator       = "Equals"
              selector       = "not_suspicious"
            }
          }
          overrides = {
            override1 = {
              rule_group_name = "PHP"
              rule = {
                rule1 = {
                  rule_id = "933100"
                  enabled = false
                  action  = "Log"
                }
              }
            }

            override2 = {
              rule_group_name = "SQLI"
              exclusions = {
                exclusion1 = {
                  match_variable = "QueryStringArgNames"
                  operator       = "Equals"
                  selector       = "really_not_suspicious"
                }
              }
              rules = {
                rule1 = {
                  rule_id = "942200"
                  action  = "Log"
                  exclusions = {
                    exclusion1 = {
                      
```

--------------------------------

### Source Control Configuration for Web App

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_to_Linux_WebApp/README.md

Configures source control for the web app, deploying code from a public GitHub repository using manual integration.

```hcl
resource "azurerm_app_service_source_control" "sourcecontrol" {
  app_id                 = azurerm_linux_web_app.webapp.id
  branch                 = "master"
  repo_url               = "https://github.com/Azure-Samples/nodejs-docs-hello-world"
  use_manual_integration = true
  use_mercurial          = false
}
```

--------------------------------

### Virtual Network Creation

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_service_to_LB/README.md

Sets up an Azure virtual network with a specified address space, which will be used to host the private link service.

```hcl
# Create a virtual network
resource "azurerm_virtual_network" "vnet" {
  location            = azurerm_resource_group.this.location
  name                = "afd-lb-vnet"
  resource_group_name = azurerm_resource_group.this.name
  address_space       = ["10.5.0.0/16"]
}
```

--------------------------------

### Terraform Configuration for Azure CDN Profile

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_to_storage_with_caching/README.md

This HCL code configures the Terraform version, required providers, and sets up the Azure provider. It also includes a naming module for CAF compliant resource names and defines essential resources for a CDN profile setup.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
}

provider "azurerm" {
  features {}
  # subscription_id = "your-subscription-id" # Replace with your Azure subscription ID
}

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "eastus"
  name     = "storagecaching-${module.naming.resource_group.name_unique}"
}

# storage account origin which will be connected to private link
resource "azurerm_storage_account" "storage" {
  account_replication_type      = "ZRS"
  account_tier                  = "Standard"
  location                      = azurerm_resource_group.this.location
  name                          = module.naming.storage_account.name_unique
  resource_group_name           = azurerm_resource_group.this.name
  public_network_access_enabled = false
}

# Create a virtual network
resource "azurerm_virtual_network" "vnet" {
  location            = azurerm_resource_group.this.location
  name                = "storage-vnet"
  resource_group_name = azurerm_resource_group.this.name
  address_space       = ["10.0.0.0/16"]
}

# Create a subnet within the virtual network
resource "azurerm_subnet" "subnet" {
  address_prefixes     = ["10.0.0.0/24"]
  name                 = "storage-subnet"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.vnet.name
}
# Create a private endpoint for the storage account
resource "azurerm_private_endpoint" "storage_endpoint" {
  location            = azurerm_resource_group.this.location
  name                = "storage-endpoint"
  resource_group_name = azurerm_resource_group.this.name
  subnet_id           = azurerm_subnet.subnet.id

  private_service_connection {
    is_manual_connection           = false
    name                           = "storage-connection"
    private_connection_resource_id = azurerm_storage_account.storage.id
    subresource_names              = ["blob"]
  }
}

# Create a private DNS zone for the storage account
resource "azurerm_private_dns_zone" "storage_dns_zone" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.this.name
}

# Link the private DNS zone to the virtual network
resource "azurerm_private_dns_zone_virtual_network_link" "dns_link" {
  name                  = "dns-link"
  private_dns_zone_name = azurerm_private_dns_zone.storage_dns_zone.name
  resource_group_name   = azurerm_resource_group.this.name
  virtual_network_id    = azurerm_virtual_network.vnet.id
}

```

--------------------------------

### Key Vault Certificate Creation

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_custom_domain_with_customer_managed_secret/README.md

Creates a certificate within an Azure Key Vault. This example configures a self-signed certificate policy with specific key usage, subject, validity, and subject alternative names. Note that self-signed certificates are not supported in AFD; a certificate chain with two or more certificates is recommended for real-world scenarios.

```hcl
resource "azurerm_key_vault_certificate" "keyvaultcert" {
  key_vault_id = module.avm_res_keyvault_vault.resource.id
  name         = "example-cert"

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }
    key_properties {
      exportable = true
      key_type   = "RSA"
      reuse_key  = true
      key_size   = 2048
    }
    secret_properties {
      content_type = "application/x-pkcs12"
    }
    lifetime_action {
      action {
        action_type = "AutoRenew"
      }
      trigger {
        days_before_expiry = 30
      }
    }
    x509_certificate_properties {
      key_usage = [
        "cRLSign",
        "dataEncipherment",
        "digitalSignature",
        "keyAgreement",
        "keyCertSign",
        "keyEncipherment",
      ]
      subject            = "CN=hello-world"
      validity_in_months = 12
      # Server Authentication = 1.3.6.1.5.5.7.3.1
      # Client Authentication = 1.3.6.1.5.5.7.3.2
      extended_key_usage = ["1.3.6.1.5.5.7.3.1"]

      subject_alternative_names {
        dns_names = ["internal.contoso.com", "domain.hello.world"]
      }
    }
  }

  depends_on = [module.avm_res_keyvault_vault]
}
```

--------------------------------

### Configure Azure CDN Front Door Profile with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_custom_domain_managed_secret/README.md

This snippet shows the main module call for creating an Azure CDN Front Door profile. It includes essential parameters like location, name, and resource group, along with configurations for custom domains, endpoints, origin groups, origins, routes, and rule sets.

```terraform
module "azurerm_cdn_frontdoor_profile" {
  source = "../../"

  location            = azurerm_resource_group.this.location
  name                = module.naming.cdn_profile.name_unique
  resource_group_name = azurerm_resource_group.this.name
  enable_telemetry    = var.enable_telemetry
  front_door_custom_domains = {
    contoso1_key = {
      name        = "contoso1"
      dns_zone_id = azurerm_dns_zone.dnszone.id
      host_name   = "contoso1.fabrikam.com"

      tls = {
        certificate_type    = "ManagedCertificate"
        minimum_tls_version = "TLS12" # TLS1.3 is not yet supported in Terraform azurerm_cdn_frontdoor_custom_domain
      }
    },
    contoso2_key = {
      name        = "contoso2"
      dns_zone_id = azurerm_dns_zone.dnszone.id
      host_name   = "contoso2.fabrikam.com"
      tls = {
        certificate_type    = "ManagedCertificate"
        minimum_tls_version = "TLS12" # TLS1.3 is not yet supported in Terraform azurerm_cdn_frontdoor_custom_domain
      }
    }
  }
  front_door_endpoints = {
    ep1_key = {
      name = "ep1-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
  }
  front_door_origin_groups = {
    og1_key = {
      name = "og1"
      health_probe = {
        hp1 = {
          interval_in_seconds = 240
          path                = "/healthProbe"
          protocol            = "Https"
          request_type        = "HEAD"
        }
      }
      load_balancing = {
        lb1 = {
          additional_latency_in_milliseconds = 0
          sample_size                        = 16
          successful_samples_required        = 3
        }
      }
    }
  }
  front_door_origins = {
    origin1_key = {
      name                           = "example-origin"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = false
      host_name                      = "contoso1.com"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "www.contoso1.com"
      priority                       = 1
      weight                         = 1
    }
    origin2_key = {
      name                           = "origin2"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = false
      host_name                      = "contoso2.com"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "www.contoso2.com"
      priority                       = 1
      weight                         = 1
    }
  }
  front_door_routes = {
    route1_key = {
      name                   = "route1"
      endpoint_key           = "ep1_key"
      origin_group_key       = "og1_key"
      origin_keys            = ["origin1_key", "origin2_key"]
      forwarding_protocol    = "HttpsOnly"
      https_redirect_enabled = true
      patterns_to_match      = ["/*"]
      supported_protocols    = ["Http", "Https"]
      rule_set_names         = ["ruleset1"]
      custom_domain_keys     = ["contoso1_key", "contoso2_key"]
      cache = {
        cache1 = {
          query_string_caching_behavior = "IgnoreSpecifiedQueryStrings"
          query_strings                 = ["account", "settings"]
          compression_enabled           = true
          content_types_to_compress     = ["text/html", "text/javascript", "text/xml"]
        }
      }
    }
  }
  front_door_rule_sets = ["ruleset1"]
  front_door_rules = {
    rule1_key = {
      name              = "examplerule1"
      order             = 1
      behavior_on_match = "Continue"
      rule_set_name     = "ruleset1"
      origin_group_key  = "og1_key"
      actions = {

        url_rewrite_actions = [{
          source_pattern          = "/"
          destination             = "/index3.html"
          preserve_unmatched_path = false
        }]
        route_configuration_override_actions = [{
          set_origin_groupid            = true
          forwarding_protocol           = "HttpsOnly"
          query_string_caching_behavior = "IncludeSpecifiedQueryStrings"
          query_string_parameters       = ["foo", "clientIp={client_ip}"]
          compression_enabled           = true
          cache_behavior                = "OverrideIfOriginMissing"
          cache_duration                = "365.23:59:59"
        }]
        response_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
        request_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
      }

      conditions = {
        remote_address_conditions = [{
          operator         = "IPMatch"
          negate_condition = false
          match_values     = ["10.0.0.0/23"]

```

--------------------------------

### Configure Azure CDN Front Door Profile with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_service_to_LB/README.md

This snippet shows the main module call for creating an Azure CDN Front Door profile. It includes essential parameters like location, name, resource group, and telemetry settings.

```terraform
module "azurerm_cdn_frontdoor_profile" {
  source = "../../"

  location            = azurerm_resource_group.this.location
  name                = module.naming.cdn_profile.name_unique
  resource_group_name = azurerm_resource_group.this.name
  enable_telemetry    = var.enable_telemetry
  front_door_endpoints = {
    ep1_key = {
      name = "ep1-${module.naming.cdn_endpoint.name_unique}"
      tags = {
        environment = "avm-demo"
      }
    }
  }
  front_door_origin_groups = {
    og1_key = {
      name = "og1"
      health_probe = {
        hp1 = {
          interval_in_seconds = 240
          path                = "/healthProbe"
          protocol            = "Https"
          request_type        = "HEAD"
        }
      }
      load_balancing = {
        lb1 = {
          additional_latency_in_milliseconds = 0
          sample_size                        = 16
          successful_samples_required        = 3
        }
      }
    }
  }
  front_door_origins = {
    origin1_key = {
      name                           = "origin1"
      origin_group_key               = "og1_key"
      enabled                        = true
      certificate_name_check_enabled = true
      host_name                      = "foo.bar"
      http_port                      = 80
      https_port                     = 443
      host_header                    = "foo.bar"
      priority                       = 1
      weight                         = 1
      private_link = {
        pl = {
          request_message        = "Please approve this private link connection"
          location               = azurerm_resource_group.this.location
          private_link_target_id = azurerm_private_link_service.pls.id
        }
      }
    }
  }
  front_door_routes = {
    route1_key = {
      name                      = "route1"
      endpoint_key              = "ep1_key"
      origin_group_key          = "og1_key"
      origin_keys               = ["origin1_key", "origin2_key"]
      forwarding_protocol       = "HttpsOnly"
      https_redirect_enabled    = true
      patterns_to_match         = ["/*"]
      supported_protocols       = ["Http", "Https"]
      rule_set_names            = ["ruleset1"]
      cdn_frontdoor_origin_path = "/originpath"
      cache = {
        cache1 = {
          query_string_caching_behavior = "IgnoreSpecifiedQueryStrings"
          query_strings                 = ["account", "settings"]
          compression_enabled           = true
          content_types_to_compress     = ["text/html", "text/javascript", "text/xml"]
        }
      }
    }
  }
  front_door_rule_sets = ["ruleset1"]
  front_door_rules = {
    rule1_key = {
      name              = "examplerule1"
      order             = 1
      behavior_on_match = "Continue"
      rule_set_name     = "ruleset1"
      origin_group_key  = "og1_key"
      actions = {

        url_rewrite_actions = [{
          source_pattern          = "/"
          destination             = "/index3.html"
          preserve_unmatched_path = false
        }]
        route_configuration_override_actions = [{
          set_origin_groupid            = true
          forwarding_protocol           = "HttpsOnly"
          query_string_caching_behavior = "IncludeSpecifiedQueryStrings"
          query_string_parameters       = ["foo", "clientIp={client_ip}"]
          compression_enabled           = true
          cache_behavior                = "OverrideIfOriginMissing"
          cache_duration                = "365.23:59:59"
        }]
        response_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
        request_header_actions = [{
          header_action = "Append"
          header_name   = "headername"
          value         = "/abc"
        }]
      }

      conditions = {
        remote_address_conditions = [{
          operator         = "IPMatch"
          negate_condition = false
          match_values     = ["10.0.0.0/23"]
        }]

        query_string_conditions = [{
          negate_condition = false
          operator         = "BeginsWith"
          match_values     = ["Query1", "Query2"]
          transforms       = ["Uppercase"]
        }]

        request_header_conditions = [{
          header_name      = "headername"
          negate_condition = false
          operator         = "BeginsWith"
          match_values     = ["Header1", "Header2"]
          transforms       = ["Uppercase"]
        }]

        request_body_conditions = [{
          negate_condition = false
          operator         = "BeginsWith"
          match_values     = ["Body1", "Body2"]
          transforms       = ["Uppercase"]
        }]

        request_scheme_conditions = [{
          negate_condition = false
          operator         = "Equal"
          match_values     = ["HTTP"]
        }]

        url_path_conditions = [{
          negate_condition = false

```

--------------------------------

### App Service Plan Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_private_link_to_Linux_WebApp/README.md

Creates an Azure App Service plan. For production, a Premium SKU is recommended over the S1 used here for testing.

```hcl
resource "azurerm_service_plan" "appservice" {
  location            = azurerm_resource_group.this.location
  name                = "asp-${module.naming.app_service_plan.name_unique}"
  os_type             = "Linux"
  resource_group_name = azurerm_resource_group.this.name
  sku_name            = "S1" # Change it to one of PremiumV3 pricing tier for Production deployment. Refer https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans#premiumv3-pricing-tier
}
```

--------------------------------

### Configure Front Door Custom Domain

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Use this snippet to manage Front Door (standard/premium) custom domains. Ensure the 'host_name' is a fully qualified domain name and configure 'tls' settings appropriately, especially when using 'CustomerCertificate'.

```terraform
front_door_custom_domains = {
  contoso1_key = {
      name        = "contoso1"
      dns_zone_id = azurerm_dns_zone.dnszone.id
      host_name   = "contoso1.fabrikam.com"
      tls = {
        certificate_type    = "ManagedCertificate"
        cdn_frontdoor_secret_key = "Secret1_key"
      }
    }
  }
```

--------------------------------

### Configure Front Door Routes in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Use this configuration to define Front Door routes, specifying origins, endpoints, supported protocols, and caching behavior. Ensure all required keys like name, endpoint_key, origin_group_key, origin_keys, patterns_to_match, and supported_protocols are provided.

```terraform
front_door_routes = {
  route1_key = {
    name                   = "route1"
    endpoint_key           = "ep1_key"
    origin_group_key       = "og1_key"
    origin_keys            = ["origin1_key"]
    https_redirect_enabled = true
    custom_domain_keys     = ["cd1_key"]
    patterns_to_match      = ["/*"]
    supported_protocols    = ["Http", "Https"]
    rule_set_names         = ["ruleset1"]
    cache = {
      cache1 = {
        query_string_caching_behavior = "IgnoreSpecifiedQueryStrings"
        query_strings                 = ["account", "settings"]
        compression_enabled           = true
        content_types_to_compress     = ["text/html", "text/javascript", "text/xml"]
      }
    }
  }
}
```

--------------------------------

### URL Path Conditions

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Configure conditions to match against the URL path.

```APIDOC
## URL Path Conditions

### Description
Conditions to match against the URL path.

### Method
Not Applicable (Configuration Block)

### Endpoint
Not Applicable (Configuration Block)

### Parameters
#### Request Body Parameters
- **operator** (string) - Required - The operator to use when matching the URL path. Possible values are 'Any', 'BeginsWith', 'Contains', 'EndsWith', 'Equal', 'LessThan', 'LessThanOrEqual', 'GreaterThan', 'greaterThanOrEqual' or 'RegEx'.
- **negate_condition** (boolean) - Optional - Should the condition be negated? Possible values are true or false. Defaults to false.
- **match_values** (array of strings or integers) - Optional - One or more string or integer values (e.g. "1") representing the value of the POST argument to match. If multiple values are specified, they're evaluated using OR logic.
- **transforms** (array of strings) - Optional - The transforms to apply to the match values. Possible values include 'Lowercase', 'RemoveNulls', 'Trim', 'Uppercase', 'UrlDecode' or 'UrlEncode'.
```

--------------------------------

### Configure Front Door Security Policies

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/README.md

Use this snippet to manage Front Door (standard/premium) Security Policies, linking firewall policies to specific endpoints and domains with defined path matching.

```terraform
front_door_security_policies = {
  secpol1_key = {
    name = "firewallpolicyforep1cd1"
    firewall = {
      front_door_firewall_policy_key = "fd_waf1_key"
      association = {
        endpoint_keys     = ["ep1_key"]
        domain_keys       = ["cd1_key"]
        patterns_to_match = ["/*"]
      }
    }
  }
}
```

--------------------------------

### CDN Front Door Profile Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-cdn-profile/blob/main/examples/afd_custom_domain_managed_secret/README.md

Configures a CDN Front Door profile with detailed conditions for rule sets. Ensure all required conditions are met for proper functioning.

```terraform
query_string_conditions = [
          {
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["Query1", "Query2"]
            transforms       = ["Uppercase"]
          }
        ]

        request_header_conditions = [
          {
            header_name      = "headername"
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["Header1", "Header2"]
            transforms       = ["Uppercase"]
          }
        ]

        request_body_conditions = [
          {
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["Request", "Body"]
            transforms       = ["Uppercase"]
          }
        ]

        request_scheme_conditions = [
          {
            negate_condition = false
            operator         = "Equal"
            match_values     = ["HTTP"]
          }
        ]

        url_path_conditions = [
          {
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["UrlPath1", "UrlPath2"]
            transforms       = ["Uppercase"]
          }
        ]

        url_file_extension_conditions = [
          {
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["ext1", "ext2"]
            transforms       = ["Uppercase"]
          }
        ]

        url_filename_conditions = [
          {
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["filename1", "filename2"]
            transforms       = ["Uppercase"]
          }
        ]

        http_version_conditions = [
          {
            negate_condition = false
            operator         = "Equal"
            match_values     = ["2.0"]
          }
        ]

        cookies_conditions = [
          {
            cookie_name      = "cookie"
            negate_condition = false
            operator         = "BeginsWith"
            match_values     = ["cookie1", "cookie2"]
            transforms       = ["Uppercase"]
          }
        ]
      }
    }
  }
  sku = "Standard_AzureFrontDoor"
}

```