Search for a command to run...
Streamline web traffic management with Azure Application Gateway and Terraform
Passionate about helping organizations build scalable infrastructure and DevOps solutions with cloud technologies. Experienced in designing robust systems, automating processes, and driving efficiency through innovative cloud solutions. Advocate for best practices in DevOps and cloud computing, committed to enabling teams to achieve their full potential.
No comments yet. Be the first to comment.
From StorageClass to LoadBalancer, building a fully functional MySQL-backed web application on AKS.
Learn to Use Python for OCR, Object Detection, Tagging, and Captioning with Azure AI Vision
Using Retrieval-Augmented Generation with LLM in Azure
Covers interview questions on Git, Docker, Kubernetes, Terraform, Ansible, Azure DevOps, and Azure Cloud
Efficient Microservices Deployment with Azure DevOps CI & GitOps with ArgoCD to AKS
Azure Application Gateway is a web traffic load balancer that helps you manage traffic to your web applications. Unlike traditional load balancers, it operates at the application layer (Layer 7) of the OSI model.
Hosting Multi-Tier Applications
Route requests to different services within your application based on the URL path.
Example: /auth routes to the authentication service, while /orders routes to the order management system.
Protecting Applications with WAF
Use the WAF feature to secure your applications against web vulnerabilities, especially when hosting sensitive data or user-facing applications.
Serving Multiple Applications on a Single Gateway
Host multiple websites or applications using different domain names or subdomains with a single Application Gateway instance.
Modernizing Legacy Applications
Implement SSL offloading and URL-based routing to improve the performance of legacy systems that lack such capabilities.
Scaling Secure Web Applications
Use autoscaling and load balancing to ensure availability and performance for applications experiencing variable or high traffic loads.
Global Applications with Centralized Security
Centralize security policies for globally distributed applications using a single WAF-enabled Application Gateway.
In this project, we are extending our network architecture by introducing a dedicated Application Gateway Subnet, similar to the previously configured App Subnet and DB Subnet.
1️⃣ Application Gateway Backend Pool:
2️⃣ Frontend IP Configuration:
3️⃣ Listeners Configuration:
4️⃣ Backend HTTP Settings:
5️⃣ Routing Rules:
6️⃣ Health Probe Configuration:
By the end of this project, the Azure Application Gateway will efficiently route and manage application traffic, ensuring optimal performance and availability.
This Terraform code configures the Application Gateway Subnet (AG Subnet), associates it with a Network Security Group (NSG), and creates inbound rules to allow traffic essential for the Application Gateway.
This setup ensures that the Application Gateway operates securely within its dedicated subnet while allowing only essential traffic. The NSG rules allow HTTP (80), HTTPS (443), and required ephemeral ports (65200-65535), ensuring proper communication and functionality.
# Create AG Subnet
resource "azurerm_subnet" "ag_subnet" {
name = "${azurerm_virtual_network.vnet.name}-${var.ag_subnet_name}"
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = var.ag_subnet_address
resource_group_name = azurerm_resource_group.rg.name
}
# Create NSG for Subnet
resource "azurerm_network_security_group" "ag_snet_nsg" {
name = "${azurerm_subnet.ag_subnet.name}-nsg"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
}
# Associate ag_subnet with ag_snet_nsg
resource "azurerm_subnet_network_security_group_association" "associate_agnet_agnsg" {
depends_on = [azurerm_network_security_rule.application_gtw_nsg_rules_inbound]
subnet_id = azurerm_subnet.ag_subnet.id
network_security_group_id = azurerm_network_security_group.ag_snet_nsg.id
}
# Locals block for security rules
locals {
ag_inbound_port_map = {
# priority:port
"100" : "80"
"110" : "443"
"130" : "65200-65535"
}
}
# Create NSG Rules using azurerm_network_security_rule resource
resource "azurerm_network_security_rule" "application_gtw_nsg_rules_inbound" {
for_each = local.ag_inbound_port_map
name = "Rule_Port_${each.value}"
access = "Allow"
direction = "Inbound"
network_security_group_name = azurerm_network_security_group.ag_snet_nsg.name
priority = each.key
protocol = "Tcp"
source_port_range = "*"
destination_port_range = each.value
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.rg.name
}
The azurerm_subnet resource creates a subnet dedicated to the Application Gateway.
Key Attributes:
address_prefixes: Specifies the address range for the subnet.
virtual_network_name: Associates the subnet with the existing Virtual Network.
resource_group_name: Links the subnet to the resource group.
The azurerm_network_security_group resource sets up an NSG for securing the Application Gateway Subnet.
Key Attributes:
location: Specifies the region of the NSG.
resource_group_name: Associates the NSG with the same resource group as the subnet.
The azurerm_subnet_network_security_group_association resource links the Application Gateway Subnet with its NSG.
Key Attributes:
subnet_id: Identifies the Application Gateway Subnet.
network_security_group_id: Associates the NSG with the subnet.
Dependency: This association is dependent on the creation of NSG rules to ensure proper configuration.
The locals block contains a map of inbound ports with their respective priorities for the Application Gateway.
Example:
Port 80 for HTTP (priority 100).
Port 443 for HTTPS (priority 110).
Ports 65200–65535 for internal communication (priority 130).
The azurerm_network_security_rule resource dynamically generates inbound security rules using the for_each loop based on the port map defined in the locals block.
Key Attributes:
priority: Ensures the order of rule evaluation.
destination_port_range: Specifies the target port(s) allowed.
protocol: Restricts to TCP traffic.
direction: Allows only inbound traffic.
access: Permits traffic matching the rule.
Ephemeral ports, also known as dynamic ports, are short-lived ports automatically allocated by the operating system to facilitate communication between a client and a server. These ports are used as the source ports for outbound traffic in a TCP/IP connection and are released once the communication is complete.
For Azure Application Gateway, ephemeral ports are crucial for managing backend connections. Here's why:
Backend Pool Communication: When the Application Gateway forwards client requests to backend servers (e.g., VMs or VMSS), it uses ephemeral ports for each session to establish a secure connection.
Load Balancing: Helps maintain multiple simultaneous connections to different backend servers, improving performance.
Avoiding Port Conflicts: Using a large range of dynamic ports reduces the risk of port conflicts between connections.
In the provided Terraform configuration, the rule to allow ephemeral ports (65200–65535) ensures:
Communication Between App Gateway and Backend Pool: This range allows the Application Gateway to connect to resources in its backend pool, such as VMs or VMSS.
Smooth Functioning of HTTP/HTTPS Traffic: Without this rule, the Application Gateway might fail to establish connections with backend instances.
Provisioning the application gateway has multiple sub-components which will be explained below
This public IP will be used for front-end communication.
# Required Resource: Azure Application Gateway Public IP
resource "azurerm_public_ip" "web_application_gateway_publicip" {
name = "${local.resource_name_prefix}-web-ag-publicip"
allocation_method = "Static"
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
sku = "Standard"
}
These variables simplify naming conventions and support multiple applications with context-path-based routing.
# Azure AG Locals Block
locals {
# Generic Configuration
frontend_port_name = "${azurerm_virtual_network.vnet.name}-feport"
frontend_ip_configuration_name = "${azurerm_virtual_network.vnet.name}-feipconfig"
listener_name = "${azurerm_virtual_network.vnet.name}-httplistener"
request_routing_rule1_name = "${azurerm_virtual_network.vnet.name}-requestrouting1"
# Application-Specific Configuration (App1)
backend_address_pool_name_app1 = "${azurerm_virtual_network.vnet.name}-bepap_app1"
http_setting_name_app1 = "${azurerm_virtual_network.vnet.name}-behttpsettung_app1"
probe_name_app1 = "${azurerm_virtual_network.vnet.name}-beprobe_app1"
}
This block provisions the gateway with a Standard_v2 SKU and configures autoscaling, frontend IP, listeners, backend pools, and routing rules.
# Resource: Azure Application Gateway
resource "azurerm_application_gateway" "web_application_gateway" {
name = "${local.resource_name_prefix}-web_application_gateway"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
# Gateway SKU and Autoscaling
sku {
name = "Standard_v2"
tier = "Standard_v2"
}
autoscale_configuration {
min_capacity = 0
max_capacity = 10 # Max 125 for Standard_v2 SKU
}
# Gateway IP Configuration
gateway_ip_configuration {
name = "ag_ip_config"
subnet_id = azurerm_subnet.ag_subnet.id
}
# Frontend Configuration
frontend_port {
name = local.frontend_port_name
port = 80
}
frontend_ip_configuration {
name = local.frontend_ip_configuration_name
public_ip_address_id = azurerm_public_ip.web_application_gateway_publicip.id
subnet_id = azurerm_subnet.ag_subnet.id
}
# HTTP Listener
http_listener {
name = local.listener_name
frontend_ip_configuration_name = local.frontend_ip_configuration_name
frontend_port_name = local.frontend_port_name
protocol = "Http"
}
# Backend Configuration for App1
backend_address_pool {
name = local.backend_address_pool_name_app1
}
backend_http_settings {
name = local.http_setting_name_app1
cookie_based_affinity = "Disabled"
port = 80
protocol = "Http"
request_timeout = 60
probe_name = local.probe_name_app1
}
# Health Probe for App1
probe {
name = local.probe_name_app1
host = "127.0.0.1"
interval = 30
timeout = 30
unhealthy_threshold = 3
protocol = "Http"
port = 80
path = "/app1/status.html"
match {
body = "App1"
status_code = ["200"]
}
}
# Request Routing Rule
request_routing_rule {
name = local.request_routing_rule1_name
rule_type = "Basic"
http_listener_name = local.listener_name
backend_address_pool_name = local.backend_address_pool_name_app1
backend_http_settings_name = local.http_setting_name_app1
}
}
Public IP:
Autoscaling:
Context-Path-Based Routing:
/app1 goes to App1 VMSS).Health Probes:
http://127.0.0.1/app1/status.html.Listener and Rule Configuration:
Previously, the Virtual Machine Scale Set (VMSS) was configured with a standard load balancer for traffic distribution. In this setup, we have transitioned the VMSS to utilize the Application Gateway's backend address pool.
A public IP is provisioned for external communication.
The Application Gateway is deployed in a dedicated subnet.
Frontend configuration is set up for HTTP traffic.
A listener receives incoming requests.
Backend pools and routing rules direct traffic to the appropriate VMSS based on the URL path.
Health probes ensure backend availability.
This Terraform configuration enables a scalable and efficient Azure Application Gateway setup with context-path-based routing and dynamic scaling that is suitable for modern applications.