azurerm_frontdoor HTTPS provisioning request fails

[sean-nixon]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.14
+ provider.azuread v0.7.0
+ provider.azurerm v1.42.0
+ provider.null v2.1.2
+ provider.random v2.2.1
+ provider.template v2.1.2

Affected Resource(s)

• azurerm_frontdoor

Terraform Configuration Files

resource "azurerm_frontdoor" "frontdoor" {
  name                = "${var.name}"
  friendly_name       = "${var.name}"
  resource_group_name = "${var.resource_group_name}"
  location            = "${var.location}"

  enforce_backend_pools_certificate_name_check = true

  backend_pool {
    name                = "${local.backend_name}"
    health_probe_name   = "web-health-probe"
    load_balancing_name = "web-lb"
    backend {
      address     = "${var.backend_web_fqdn}"
      host_header = "${var.backend_web_fqdn}"
      http_port   = 80
      https_port  = 443
    }
  }

  backend_pool_load_balancing {
    name = "web-lb"
  }

  backend_pool_health_probe {
    name                = "web-health-probe"
    path                = "/_health_check"
    protocol            = "Https"
    interval_in_seconds = "30"
  }

  frontend_endpoint {
    name                                    = "${local.frontend_name}"
    host_name                               = "${var.frontend_web_fqdn}"
    web_application_firewall_policy_link_id = "${azurerm_frontdoor_firewall_policy.waf_policy.id}"
    custom_https_provisioning_enabled       = true
    custom_https_configuration {
      certificate_source = "FrontDoor"
    }
  }

  frontend_endpoint {
    custom_https_provisioning_enabled = false
    host_name                         = "${var.name}.azurefd.net"
    name                              = "defaultHostName"
    session_affinity_enabled          = true
    session_affinity_ttl_seconds      = 0
  }

  routing_rule {
    name               = "web-primary-rule"
    accepted_protocols = ["Https"]
    frontend_endpoints = ["${local.frontend_name}"]
    patterns_to_match  = ["/*"]
    enabled            = true

    forwarding_configuration {
      backend_pool_name   = "${local.backend_name}"
      forwarding_protocol = "HttpsOnly"
      cache_enabled       = false
    }
  }
}

Expected Behavior

Custom Domain HTTPS is enabled successfully.

Actual Behavior

Error:

azurerm_frontdoor.frontdoor: Unable enable Custom Domain HTTPS for Frontend Endpoint "mycustomdomain.example.com" (Resource Group "REDACTED"): Error enabling Custom Domain HTTPS for Frontend Endpoint: frontdoor.FrontendEndpointsClient#EnableHTTPS: Failure sending request: StatusCode=400 -- Original Error: Code="BadRequest" Message="\"minimumTlsVersion\" is a mandatory parameter."

Steps to Reproduce

1. Setup CNAME DNS record to point to new Azure Frontdoor frontend
2. Run terraform apply with custom https provisioning enabled on custom domain

References

The minimumTlsVersion parameter is required in the current API version:
https://docs.microsoft.com/en-us/rest/api/frontdoorservice/frontdoor/frontendendpoints/enablehttps

The SDK version was upgraded in #5385, thus upgrading the Frontdoor API version used. I believe this is the source of the bug.

[georgegil]

Yep, got the same issue. Setting provider back to 1.41.0 works...

[ghost]

This has been released in version 1.43.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 1.43.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!