azurerm_cdn_endpoint support for custom domains

[hashibot]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

This issue was originally opened by @iustinam as hashicorp/terraform#16261. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Hi,
Is there any plan to add support for CDN custom domains? I could not find that in https://github.com/hashicorp/terraform/pull/4759/files
Azure templates have support for that as in:
https://docs.microsoft.com/en-us/azure/templates/microsoft.cdn/profiles/endpoints
https://docs.microsoft.com/en-us/azure/templates/microsoft.cdn/profiles/endpoints/customdomains

Thanks

[tombuildsstuff]

Just checked - this is now in the SDK so we should be able to proceed with this soon 👍

[kirkmadera]

The current documentation reads as if this is possible in the description. Maybe in the immediate, the documentation should be noted that this feature is not yet available.

The CDN Endpoint is exposed using the URL format .azureedge.net by default, but custom domains can also be created.

[mioi]

custom domain support would be most beneficial.

[tombuildsstuff]

Hey folks! Just to let you know that we’re planning on taking a look at this this week :)

[kirkmadera]

Note I learned through recent experience with Microsoft's support team that only Verizon_Standard and Verizon_Premium support custom domains. The Akamai_Standard implementation currently doesn't support custom domains.

[dcolebatch]

I learned through experience that much of what I needed to configure for the Verizon_Premium CDN could only be done through the verizon configuration portal and that domain validation required tickets to be bridged from Microsoft to Verizon to execute with an 8hr SLA.

I captured what I experienced here[1] and here[2] and I will follow this thread to hopefully revisit this someday?

1: https://azure.serverlessexample.ga/index.html
2: https://blog.tidalmigrations.com/serverless-on-azure-for-beginners-with-cloudflare-and-terraform-98a746d0f095

[thomasbeauvais]

How is this open for 3 years? It's supported by the Azure CLI/SDK for some time now.

Why would I have a CDN and no custom domain?

(sorry for the passive aggressiveness, manual steps always erk me)

All Hail Terraform!

[kingsleyadam]

For anyone looking for a workaround that requires everything to be in code/terraform.

You can use FrontDoor as the Frontend with caching and a storage account backend.

Although the terraform resources for FrontDoor are extremely unstable right now. At least they exist.

[orecht]

Another workaround is to use call the following az command in local-exec block. It requires Azure CLI to be installed and configured, though.

az cdn custom-domain create
az cdn custom-domain enable-https

az cdn endpoint validate-custom-domain can be used to check the domain name is free before trying calling az cdn custom-domain create

[Bluffkin]

Another workaround is to use call the following az command in local-exec block. It requires Azure CLI to be installed and configured, though.

az cdn custom-domain create
az cdn custom-domain enable-https

az cdn endpoint validate-custom-domain can be used to check the domain name is free before trying calling az cdn custom-domain create

This doesn't help if you want to maintain the list of custom domains in a state though. It only works on the first creation or I guess if something need changing. Probably wouldn't recommend this way

[aeirola]

ARM Templates seem to support creating custom domains (https://docs.microsoft.com/en-us/azure/templates/microsoft.cdn/profiles/endpoints/customdomains), which could be combined in terraform with resource_group_template_deployment for custom domain creation.

Unfortunately the ARM templates don't support HTTPS. This could of course be further worked around by using ARM template deployment scripts (https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-script-template) also within resource_group_template_deployment. Not sure if that is feasible anymore though.

[BartekPog]

Is there any update on the topic? It is an issue of high importance - I am probably not the only one willing to use it in a production environment in which many unstable workarounds may cause downtime.

[Carlos-724]

Is there any update on the topic? It is an issue of high importance - I am probably not the only one willing to use it in a production environment in which many unstable workarounds may cause downtime.

Hi, no, you are not. Please help us. Implementing custom domain would be very appreciate
https://docs.microsoft.com/en-us/azure/cdn/cdn-custom-ssl?tabs=option-1-default-enable-https-with-a-cdn-managed-certificate#tlsssl-certificates

[andydkelly-ig]

I too am looking for this. I recently moved one of my CDN's from Microsoft to Akamai and having the local exec running pwsh was clunky at best.

[magodo]

Just submit a PR #11120 to support custom domain without HTTPS. There are still something needs to investigate for the HTTPS settings, and the test takes quite a long time to finish (>8hr to create + >8hr to delete). So bear with me 😅

[robtayl0r]

I believe the 8 hour window applies to a recently purged custom domain. In which previously, https had been enabled, ownership confirmed, and an Azure managed cert was created. I've come across such an error when using the Azure Portal.

[dgillman]

I just came across this issue and am wondering if there is any word on the proposed solution? I see it is marked as a Draft PR. Is there work which needs attention that will help get this over the line? Or does the PR just need to be moved out of Draft status and reviewed?

I need this functionality so can contribute a small amount of time if there is something needed.

EDIT: alternately, can someone point me to a workaround which can resolve creation of an HTTPS endpoint on a custom domain name?

[magodo]

@dgillman The PR #11166 is based on #11120, once #11120 is merged I'll rebase #11166 on top of the main branch and switch it to be a formal PR.

[magodo]

An update on PR #11120:

Althoug the #11231 is closed, while the CDN service team told that currently customers cannot opt out the breaking change behvavior as stated in #11231 on their own as its not an AutoApprove feature. The feature has to be enabled by the PG team. This means, this PR is still blocked.

[StefanSchoof]

Is this issues resolved with the merge of #12496 or does this issue also contains HTTPS Support for custom domains?

[magodo]

@StefanSchoof The https is still not yet supported as I'm currently occupied by other stuff, sorry for that..

[StefanSchoof]

@magodo Thanks you for adding the HTTP Part. No need to apologize. I just wanted to get clarification, if this issue is also for the HTTPS Part or if I should search for a other issue to keep up to date.

Sorry, that my post was a little direct. I had no intention to be pushy.

[magodo]

Due to there is some issues in the Azure Go SDK (details), PR #13283 is blocked. I'll submit a Go SDK release request to fix that.

[RemusDutulescu]

Don't mean to rush anybody, but any update on this?

[ManhNV103]

Hi folks, any update on HTTPS support?

We're currently using Azure CLI as a workaround, but it's not ideal.

[dc232]

Appreciate all the PRs that have gone into this, was wondering if there is any update in terms of the submitted PR in regards to this issue

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.