10. Front Door / DNS / Custom Domain

AWS との対応表

Azure DNS Zone

resource "azurerm_dns_zone" "main" {
  name                = "myapp.com"
  resource_group_name = azurerm_resource_group.main.name

  tags = local.common_tags
}

# A レコード
resource "azurerm_dns_a_record" "root" {
  name                = "@"
  zone_name           = azurerm_dns_zone.main.name
  resource_group_name = azurerm_resource_group.main.name
  ttl                 = 300
  records             = ["203.0.113.10"]
}

# CNAME（Front Door 等を指す）
resource "azurerm_dns_cname_record" "www" {
  name                = "www"
  zone_name           = azurerm_dns_zone.main.name
  resource_group_name = azurerm_resource_group.main.name
  ttl                 = 300
  record              = azurerm_cdn_frontdoor_endpoint.main.host_name
}

# Apex を Front Door に向ける（Alias レコード）
resource "azurerm_dns_a_record" "apex_to_fd" {
  name                = "@"
  zone_name           = azurerm_dns_zone.main.name
  resource_group_name = azurerm_resource_group.main.name
  ttl                 = 300
  target_resource_id  = azurerm_cdn_frontdoor_endpoint.main.id
}

output "name_servers" {
  value = azurerm_dns_zone.main.name_servers   # ドメインレジストラに登録
}

Front Door の構造

Front Door は 5 つのコンポーネントから構成:

1. Profile: 全体の入れ物
2. Endpoint: 公開エンドポイント（xxxxx.azurefd.net）
3. Origin Group: バックエンドのグループ
4. Origin: 個別バックエンド（Storage、App Service、Container Apps 等）
5. Route: パスマッチ → Origin Group のルール

resource "azurerm_cdn_frontdoor_profile" "main" {
  name                = "fd-myapp-prd"
  resource_group_name = azurerm_resource_group.main.name
  sku_name            = "Standard_AzureFrontDoor"   # or Premium (WAF 強化)
}

resource "azurerm_cdn_frontdoor_endpoint" "main" {
  name                     = "myapp-prd-ep"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
}

resource "azurerm_cdn_frontdoor_origin_group" "main" {
  name                     = "default"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id

  load_balancing {
    sample_size                 = 4
    successful_samples_required = 3
  }

  health_probe {
    interval_in_seconds = 30
    path                = "/health"
    protocol            = "Https"
    request_type        = "GET"
  }
}

resource "azurerm_cdn_frontdoor_origin" "storage" {
  name                          = "storage-static"
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.main.id

  enabled                        = true
  host_name                      = azurerm_storage_account.site.primary_web_host
  https_port                     = 443
  origin_host_header             = azurerm_storage_account.site.primary_web_host
  priority                       = 1
  weight                         = 1000
  certificate_name_check_enabled = true
}

resource "azurerm_cdn_frontdoor_route" "main" {
  name                          = "default"
  cdn_frontdoor_endpoint_id     = azurerm_cdn_frontdoor_endpoint.main.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.main.id
  cdn_frontdoor_origin_ids      = [azurerm_cdn_frontdoor_origin.storage.id]

  supported_protocols    = ["Http", "Https"]
  patterns_to_match      = ["/*"]
  forwarding_protocol    = "HttpsOnly"
  https_redirect_enabled = true
  link_to_default_domain = true

  cache {
    compression_enabled = true
  }
}

独自ドメイン + Managed Certificate

resource "azurerm_cdn_frontdoor_custom_domain" "main" {
  name                     = "myapp-com"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
  dns_zone_id              = azurerm_dns_zone.main.id
  host_name                = "www.myapp.com"

  tls {
    certificate_type    = "ManagedCertificate"   # Azure 提供無料証明書、自動更新
    minimum_tls_version = "TLS12"
  }
}

# Custom Domain と Route を関連付け
resource "azurerm_cdn_frontdoor_custom_domain_association" "main" {
  cdn_frontdoor_custom_domain_id = azurerm_cdn_frontdoor_custom_domain.main.id
  cdn_frontdoor_route_ids        = [azurerm_cdn_frontdoor_route.main.id]
}

# 検証用 TXT レコード（Front Door が要求）
resource "azurerm_dns_txt_record" "validation" {
  name                = "_dnsauth.www"
  zone_name           = azurerm_dns_zone.main.name
  resource_group_name = azurerm_resource_group.main.name
  ttl                 = 3600

  record {
    value = azurerm_cdn_frontdoor_custom_domain.main.validation_token
  }
}

完成形（静的サイト + 独自ドメイン）

上記を組み合わせると、AWS 章 08（このサイトの構成）と同等の 独自ドメイン + HTTPS + CDN 配信 が Azure 上で再現可能。Storage Account の static_website にコンテンツを置き、Front Door を前段に。

CDN（Front Door とは別）

歴史的経緯で「Azure CDN（旧）」と「Front Door（新）」が並存していますが、新規は Front Door 一択。旧 CDN は段階的に縮退中です。