Front Door & CDN Guide

# Create an Azure Front Door profile (Premium tier)
az afd profile create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --sku Premium_AzureFrontDoor \
  --tags project=myapp environment=production

# Create an endpoint
az afd endpoint create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --enabled-state Enabled

# Create an origin group with health probes
az afd origin-group create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --origin-group-name og-webapp \
  --probe-request-type HEAD \
  --probe-protocol Https \
  --probe-interval-in-seconds 30 \
  --probe-path "/health" \
  --sample-size 4 \
  --successful-samples-required 3 \
  --additional-latency-in-milliseconds 50

# Add primary origin (East US App Service)
az afd origin create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --origin-group-name og-webapp \
  --origin-name origin-eastus \
  --host-name myapp-eastus.azurewebsites.net \
  --origin-host-header myapp-eastus.azurewebsites.net \
  --http-port 80 \
  --https-port 443 \
  --priority 1 \
  --weight 1000 \
  --enabled-state Enabled

# Add secondary origin (West US App Service)
az afd origin create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --origin-group-name og-webapp \
  --origin-name origin-westus \
  --host-name myapp-westus.azurewebsites.net \
  --origin-host-header myapp-westus.azurewebsites.net \
  --http-port 80 \
  --https-port 443 \
  --priority 1 \
  --weight 1000 \
  --enabled-state Enabled

# Create a route to connect the endpoint to the origin group
az afd route create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --route-name route-default \
  --origin-group og-webapp \
  --supported-protocols Https \
  --https-redirect Enabled \
  --patterns-to-match "/*" \
  --forwarding-protocol HttpsOnly \
  --link-to-default-domain Enabled

# Create a rule set for URL rewriting and header manipulation
az afd rule-set create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --rule-set-name SecurityHeaders

# Add a rule to set security headers on all responses
az afd rule create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --rule-set-name SecurityHeaders \
  --rule-name AddSecurityHeaders \
  --order 1 \
  --match-variable RequestMethod \
  --operator Equal \
  --match-values GET POST \
  --action-name ModifyResponseHeader \
  --header-action Append \
  --header-name "Strict-Transport-Security" \
  --header-value "max-age=31536000; includeSubDomains"

# Create separate origin group for static assets (blob storage)
az afd origin-group create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --origin-group-name og-static \
  --probe-request-type HEAD \
  --probe-protocol Https \
  --probe-interval-in-seconds 120 \
  --probe-path "/"

az afd origin create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --origin-group-name og-static \
  --origin-name origin-storage \
  --host-name stmyappstatic.blob.core.windows.net \
  --origin-host-header stmyappstatic.blob.core.windows.net \
  --https-port 443 \
  --priority 1 \
  --weight 1000

# Create a route for static assets with longer cache TTL
az afd route create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --route-name route-static \
  --origin-group og-static \
  --supported-protocols Https \
  --https-redirect Enabled \
  --patterns-to-match "/static/*" "/images/*" "/css/*" "/js/*" \
  --forwarding-protocol HttpsOnly \
  --link-to-default-domain Enabled \
  --query-string-caching-behavior IgnoreQueryString

# Create a WAF policy for Front Door (Premium tier)
az network front-door waf-policy create \
  --resource-group rg-frontdoor \
  --name wafMyAppProd \
  --sku Premium_AzureFrontDoor \
  --mode Prevention \
  --redirect-url "https://myapp.com/blocked"

# Enable managed rule sets (OWASP and bot protection)
az network front-door waf-policy managed-rules add \
  --resource-group rg-frontdoor \
  --policy-name wafMyAppProd \
  --type Microsoft_DefaultRuleSet \
  --version 2.1 \
  --action Block

az network front-door waf-policy managed-rules add \
  --resource-group rg-frontdoor \
  --policy-name wafMyAppProd \
  --type Microsoft_BotManagerRuleSet \
  --version 1.0 \
  --action Block

# Add a custom rule: block requests from specific countries
az network front-door waf-policy rule create \
  --resource-group rg-frontdoor \
  --policy-name wafMyAppProd \
  --name GeoBlockRule \
  --priority 100 \
  --action Block \
  --rule-type MatchRule \
  --match-variable RemoteAddr \
  --operator GeoMatch \
  --match-values "XX" "YY"

# Add a custom rule: rate limit per IP (100 requests per 5 minutes)
az network front-door waf-policy rule create \
  --resource-group rg-frontdoor \
  --policy-name wafMyAppProd \
  --name RateLimitPerIP \
  --priority 200 \
  --action Block \
  --rule-type RateLimitRule \
  --rate-limit-threshold 100 \
  --rate-limit-duration-in-minutes 5 \
  --match-variable RemoteAddr \
  --operator IPMatch \
  --match-values "0.0.0.0/0"

# Associate WAF policy with Front Door security policy
az afd security-policy create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --security-policy-name sp-waf \
  --waf-policy /subscriptions/<sub-id>/resourceGroups/rg-frontdoor/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/wafMyAppProd \
  --domains /subscriptions/<sub-id>/resourceGroups/rg-frontdoor/providers/Microsoft.Cdn/profiles/afd-myapp-prod/afdEndpoints/myapp-endpoint

# Add a custom domain to the Front Door endpoint
az afd custom-domain create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --custom-domain-name www-myapp-com \
  --host-name www.myapp.com \
  --certificate-type ManagedCertificate \
  --minimum-tls-version TLS12

# The command will output a validation token
# Create a DNS TXT record for domain validation:
# _dnsauth.www.myapp.com -> <validation-token>
# Then create a CNAME record:
# www.myapp.com -> myapp-endpoint.z01.azurefd.net

# Check domain validation status
az afd custom-domain show \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --custom-domain-name www-myapp-com \
  --query '{Domain:hostName, ValidationState:validationProperties.validationState, CertStatus:tlsSettings.certificateType}' \
  --output table

# Associate the custom domain with a route
az afd route update \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --route-name route-default \
  --custom-domains www-myapp-com

# Update route with caching enabled
az afd route update \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --route-name route-static \
  --enable-caching true \
  --query-string-caching-behavior IgnoreQueryString

# Create a rule set for cache customization
az afd rule-set create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --rule-set-name CacheRules

# Rule: Cache images for 7 days
az afd rule create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --rule-set-name CacheRules \
  --rule-name CacheImages \
  --order 1 \
  --match-variable UrlFileExtension \
  --operator Equal \
  --match-values jpg jpeg png gif webp svg ico \
  --action-name CacheExpiration \
  --cache-behavior Override \
  --cache-duration "7.00:00:00"

# Rule: Cache CSS/JS for 1 day with query string differentiation
az afd rule create \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --rule-set-name CacheRules \
  --rule-name CacheAssets \
  --order 2 \
  --match-variable UrlFileExtension \
  --operator Equal \
  --match-values css js \
  --action-name CacheExpiration \
  --cache-behavior Override \
  --cache-duration "1.00:00:00"

# Purge cached content when you deploy new versions
az afd endpoint purge \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --content-paths "/static/*" "/css/*" "/js/*"

# Purge everything
az afd endpoint purge \
  --resource-group rg-frontdoor \
  --profile-name afd-myapp-prod \
  --endpoint-name myapp-endpoint \
  --content-paths "/*"

# View Front Door metrics
az monitor metrics list \
  --resource /subscriptions/<sub-id>/resourceGroups/rg-frontdoor/providers/Microsoft.Cdn/profiles/afd-myapp-prod \
  --metric "RequestCount" "ByteResponseSize" "OriginLatency" "TotalLatency" \
  --aggregation Total Average \
  --interval PT1H \
  --output table

# Enable diagnostic settings for detailed logging
az monitor diagnostic-settings create \
  --resource /subscriptions/<sub-id>/resourceGroups/rg-frontdoor/providers/Microsoft.Cdn/profiles/afd-myapp-prod \
  --name afd-diagnostics \
  --workspace /subscriptions/<sub-id>/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-central \
  --logs '[
    {"category": "FrontDoorAccessLog", "enabled": true},
    {"category": "FrontDoorHealthProbeLog", "enabled": true},
    {"category": "FrontDoorWebApplicationFirewallLog", "enabled": true}
  ]' \
  --metrics '[{"category": "AllMetrics", "enabled": true}]'