Terraform部署Azure Frontdoor静态站点遇400无效URI问题排查

问题描述 #

通过Terraform部署Azure存储账户（静态网站）+Front Door，直接访问存储账户的静态站点可正常打开index.html，但通过Front Door访问时出现400无效URI错误。

问题排查与解决方案 #

经过分析，问题主要集中在Front Door的健康探测兼容性和源端点配置细节上，以下是具体修正点：

1. 健康探测请求类型不兼容 #

Azure存储静态网站端点对HEAD请求的支持有限，改用GET请求作为健康探测可避免探测失败导致的路由异常。

2. 显式配置源端口 #

虽然默认端口为80/443，显式配置可消除潜在的端口转发歧义，确保请求正确送达存储端点。

修正后的Terraform代码 #

# Storage Account to host static content
resource "azurerm_storage_account" "sa" {
  name                     = var.storage_account_name
  resource_group_name      = var.resource_group_name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  static_website {
    index_document     = "index.html"
    error_404_document = "error_404.html"
  }
}

# Front Door Profile
resource "azurerm_cdn_frontdoor_profile" "fd_profile" {
  name                = "${azurerm_storage_account.sa.name}-fdprofile"
  resource_group_name = var.resource_group_name
  sku_name            = "Standard_AzureFrontDoor"
}

# Front Door Origin Group
resource "azurerm_cdn_frontdoor_origin_group" "fd_origin_group" {
  name                     = "${azurerm_storage_account.sa.name}-origingroup"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.fd_profile.id

  load_balancing {
    sample_size                 = 4
    successful_samples_required = 3
  }

  health_probe {
    path                = "/index.html"
    request_type        = "GET"  # 替换为GET请求，兼容存储静态网站
    protocol            = "Https"
    interval_in_seconds = 100
  }
}

# Front Door Origin
resource "azurerm_cdn_frontdoor_origin" "fd_storage_origin" {
  name                           = "${azurerm_storage_account.sa.name}-origin"
  cdn_frontdoor_origin_group_id  = azurerm_cdn_frontdoor_origin_group.fd_origin_group.id
  host_name                      = azurerm_storage_account.sa.primary_web_host
  origin_host_header             = azurerm_storage_account.sa.primary_web_host
  http_port                      = 80  # 显式配置HTTP端口
  https_port                     = 443 # 显式配置HTTPS端口
  certificate_name_check_enabled = false
}

# Front Door Endpoint
resource "azurerm_cdn_frontdoor_endpoint" "fd_endpoint" {
  name                     = "${azurerm_storage_account.sa.name}-endpoint" # 确保此名称全局唯一
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.fd_profile.id
}

# Front Door Route
resource "azurerm_cdn_frontdoor_route" "fd_route" {
  name                          = "${azurerm_storage_account.sa.name}-route"
  cdn_frontdoor_endpoint_id     = azurerm_cdn_frontdoor_endpoint.fd_endpoint.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.fd_origin_group.id
  cdn_frontdoor_origin_ids      = [azurerm_cdn_frontdoor_origin.fd_storage_origin.id]

  patterns_to_match   = ["/*"]
  forwarding_protocol = "HttpsOnly"
  supported_protocols = ["Https", "Http"]

  cache {
    query_string_caching_behavior = "IgnoreQueryString"
    compression_enabled           = true
    content_types_to_compress     = ["text/html", "text/css", "application/javascript", "application/json"]
  }
}

额外检查点 #

• 确认Front Door Endpoint名称为全局唯一（需符合*.azurefd.net的唯一性要求）。
• 验证存储账户静态网站的index.html已正确上传至$web容器。
• 等待Front Door部署完成（通常需10-15分钟）后再测试访问。

内容的提问来源于stack exchange，提问作者Brenwell