如何在现有Azure Front Door配置中新增azurerm_cdn_frontdoor_route？

方法1：直接硬编码Origin资源ID（临时/测试场景） #

如果Origin已存在，可直接在Azure Portal中找到该Origin的资源ID，将其填入cdn_frontdoor_origin_ids参数：

resource "azurerm_cdn_frontdoor_route" "example" {
  name                         = "example-route"
  cdn_frontdoor_endpoint_id    = azurerm_cdn_frontdoor_endpoint.example.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.example.id
  cdn_frontdoor_origin_ids     = ["/subscriptions/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/example-rg/providers/Microsoft.Cdn/profiles/example-profile/originGroups/example-group/origins/example-origin"]

  forwarding_protocol = "HttpsOnly"
  patterns_to_match   = ["/*"]
}

注意：此方法适合临时测试，缺点是Origin资源ID变更时需手动更新代码，不适合长期维护。

方法2：通过资源组数据源筛选获取Origin ID #

虽然没有专门的azurerm_cdn_frontdoor_origin数据源，但可以借助azurerm_resource_group数据源遍历资源组内的资源，筛选出Front Door Origin类型的资源ID：

data "azurerm_resource_group" "example" {
  name = "example-rg"
}

locals {
  target_frontdoor_origin = [
    for res in data.azurerm_resource_group.example.resources : res.id
    if res.type == "Microsoft.Cdn/profiles/originGroups/origins"
    and res.name == "example-origin" # 按实际Origin名称精准筛选
  ]
}

resource "azurerm_cdn_frontdoor_route" "example" {
  name                         = "example-route"
  cdn_frontdoor_endpoint_id    = azurerm_cdn_frontdoor_endpoint.example.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.example.id
  cdn_frontdoor_origin_ids     = local.target_frontdoor_origin

  forwarding_protocol = "HttpsOnly"
  patterns_to_match   = ["/*"]
}

此方法可动态获取ID，避免硬编码，但需确保筛选条件准确，防止匹配到无关资源。

方法3：将现有Origin导入Terraform状态（长期规范方案） #

如果需要长期维护，建议将现有Origin资源导入Terraform状态，实现资源的统一管理：

1. 先编写匹配现有Origin属性的资源定义：

resource "azurerm_cdn_frontdoor_origin" "example" {
  name                         = "example-origin"
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.example.id
  host_name                    = "example-origin.azurewebsites.net" # 与现有Origin的实际值一致
  http_port                    = 80
  https_port                   = 443
}

2. 执行导入命令，将现有Origin纳入Terraform状态：

terraform import azurerm_cdn_frontdoor_origin.example /subscriptions/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/resourceGroups/example-rg/providers/Microsoft.Cdn/profiles/example-profile/originGroups/example-group/origins/example-origin

3. 导入完成后，即可直接在Route资源中引用Origin的ID：

resource "azurerm_cdn_frontdoor_route" "example" {
  name                         = "example-route"
  cdn_frontdoor_endpoint_id    = azurerm_cdn_frontdoor_endpoint.example.id
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.example.id
  cdn_frontdoor_origin_ids     = [azurerm_cdn_frontdoor_origin.example.id]

  forwarding_protocol = "HttpsOnly"
  patterns_to_match   = ["/*"]
}

此方法是最规范的长期解决方案，能避免配置漂移，让Terraform完全管控相关资源。

内容的提问来源于stack exchange，提问作者AllmanTool