The Azure Front Door integration enables automatic collection and analysis of API request and response data that flows through your Azure Front Door service. The integration captures transaction data between downstream clients and upstream services, then sends the data to the Cequence platform for security analysis and threat detection. Azure Front Door acts as a centralized gateway, making it an ideal collection point for comprehensive API visibility, since it captures all client-server interactions without requiring individual instrumentation of backend services. This gateway-level approach provides complete traffic analysis across your entire API ecosystem. This article is intended for Azure administrators and Cequence integration engineers who are setting up API traffic collection through Azure Front Door.

Azure Front Door architecture

Azure Front Door is a cloud-based service that accelerates content delivery, enhances security, and improves the reliability of global applications. Azure Front Door combines features of a Content Delivery Network (CDN), global load balancing, and advanced security to optimize web application performance and protect against threats.

Key features include the following.

• Content delivery optimization for improved performance.
• Global load balancing across multiple regions.
• Dynamic site acceleration (DSA) capabilities.
• Advanced security features for threat protection.
• Private link support for secure connections.
• Managed identity integration.
• Real-time analytics and monitoring.

Before you start

Verify that your environment meets these requirements.

• Azure CLI installation.
• Azure Function Core Tools 4.
• Go/Golang installation.
• Active Azure subscription with appropriate permissions.
• Network access to Cequence Authentication and Edge endpoints.

What you'll need

Before beginning the installation, obtain these credentials and endpoints from your Cequence administrator.

• Client ID.
• Client secret.
• Transaction endpoint URL.
• Token endpoint URL.

Additionally, gather these Azure credentials.

• Azure tenant ID.
• Service principal ID.
• Service principal secret.

Items to download

Download the integration bundle from your Cequence representative. The bundle file is named cequence_afd_integration_bundle_XXXXX_XXXXX.tar.gz. This bundle contains the following items.

• Deployment scripts for installation and removal.
• Configuration files and examples.
• Terraform modules for infrastructure deployment.
• Helper scripts and modular components.
• Documentation and troubleshooting guides.

Installing the integration

The Azure Front Door integration supports automated deployment that uses Terraform. Complete the following steps to prepare and deploy the integration.

Step 1: Extracting the integration bundle

tar -xvf cequence_afd_integration_bundle_XXXXX_XXXXX.tar.gz

The extracted bundle structure includes the following files and directories:

Bundle Contents:
   ├── scripts/ (deployment scripts)
   |----------/enable_afd_integration.sh
   |----------/disable_afd_integration.sh
   ├── scripts/config/ (configuration files)
   ├── scripts/helpers/ (helper scripts including refactored AFD manager)
   │   ├── afd_manager_refactored.py (new modular AFD manager)
   │   ├── logger.py (shared logging module)
   │   └── afd_manager_helpers/ (modular helper classes)
   ├── terraform/base/ (base terraform)
   ├── terraform/cequence_azure_timer_function/ (function terraform)
   └── zip_tracking.txt (zip file history)

Step 2: Configuring environment variables

cd scripts/config
cp config-example.jsonc config.jsonc

Edit the config.jsonc file with your specific configuration values:

{
    "cequenceConfig": {
        "CQ_DEPLOYMENT_METHOD": "terraform",
        "discoverAFDsAutomatically": true,
        "enableFunction": true,
        "redeployFunction": true,
        "afdsToProcessManually": [
            {
                "subscription": "xxxx-xxxx-xxx-xxx-xxxx",
                "resourceGroup": "xxx-test-qa",
                "frontDoorName": "front-door-xx-xx"
            }
        ],
        "terraformConfig": {
            "storeStateInCloud": true,
            "backendStorageAccount": "xxxx",
            "backendContainer": "tfstate",
            "backendResourceGroup": "xxx-test-xx",
            "backendSubscription": "xxxx-xxx-xx-xx-xx",
            "terraformAutoApprove": true
        },
        "resourceNaming": {
            "storageAccountPrefix": "Cequence-SA",
            "functionAppPrefix": "Cequence-FunctionApp"
        },
        "cequenceFunctionAppSettings": {
            "CQ_AUTH_TOKEN_URL": "https://auth.common.xxxx.int.cequence.ai/auth/realms/user-example/protocol/openid-connect/token",
            "CQ_TRANSACTION_ENDPOINT_URL": "https://edge.user-example.xxxx.int.cequence.ai/api-transactions",
            "CQ_CLIENT_ID": "example-test-client",
            "CQ_CLIENT_SECRET": "secret",
            "CQ_SRC_GW_NAME": "azure-frontdoor",
            "CQ_LIB_VERSION": "1.1",
            "CQ_MAX_MESSAGE_SIZE": "10000000",
            "CQ_BATCH_SIZE": "100",
            "CQ_MAX_BATCHES": "200",
            "CQ_BATCH_INTERVAL": "5000",
            "CQ_DISABLE_CERT_VALIDATION": "false",
            "CQ_TRANSACTION_ENDPOINT_TYPE": "uap",
            "CQ_AUTH_TYPE": "oauth2",
            "CQ_ENABLE_AUTH": "true",
            "LOG_LEVEL": "DEBUG",
            "FUNCTION_TIMEOUT_SECONDS": "55",
            "PROCESSING_TIME_LIMIT_SECONDS": "40",
            "SUPPORTED_RES_CONTENT_TYPES": "^[ ]*application/xml[ ]*;?.*$|^[ ]*application/soap\+xml[ ]*;?.*$|^[ ]*text/xml[ ]*;?.*$|^[ ]*application/soap[ ]*;?.*$|^[ ]*application/json[ ]*;?.*$|^[ ]*application/x-www-form-urlencoded[ ]*;?.*$|^[ ]*text/html[ ]*;?.*$",
            "UNSUPPORTED_STATIC_EXTENSIONS": "\.(jpg|jpeg|png|gif|ico|css|js|csv|doc|docx|xls|xlsx|pdf|txt|zip|tar|gz|rar|exe|dll|bin)$"
        }
    },
    "azureConfig": {
        "tenantId": "xxxx-xxxx-xx-xx-xxxx",
        "servicePrincipalId": "xxxx-xxx-xx-xx-xxx",
        "servicePrincipalSecret": "xxxxxxx"
    },
    "loggingConfig": {
        "logLevel": "DEBUG",
        "showTerraformOutput": true,
        "showDebugInfo": true
    }
}

Step 3: Setting up diagnostic settings

Configure diagnostic settings on Azure Front Door to forward logs to a Storage Account.

1. Open your Front Door instance in the Azure portal.
2. From the left navigation panel, select Monitoring, then select Diagnostic settings.
3. Select Add diagnostic setting.
4. Select Front Door Access log.
5. From the Destination Details section, select Archive to a storage account.
6. Select the appropriate subscription and storage account.
7. Select Save.

Step 4: Deploying the integration

Navigate to the scripts directory and make the deployment script executable:

cd scripts
chmod +x enable_afd_integration.sh
./enable_afd_integration.sh

Enabling the integration globally

A properly configured integration operates globally by default. Set discoverAFDsAutomatically to true in your configuration to automatically discover all Azure Front Door instances in your subscription.

Enabling the integration for an individual API

To process specific Azure Front Door instances manually, set discoverAFDsAutomatically to false and specify the instances in the afdsToProcessManually array, as in the following example.

"afdsToProcessManually": [
            {
                "subscription": "xxxx-xxxx-xxx-xxx-xxxx",
                "resourceGroup": "xxx-test-qa",
                "frontDoorName": "front-door-xx-xx"
            }
        ],

Disabling the integration

There are two methods to disable the integration.

Method 1: Complete removal

Run the disable script to remove all integration components completely. The script removes all function apps, diagnostic settings, and storage accounts that the integration creates.

./disable_afd_integration.sh

Method 2: Partial rollback

To remove specific Front Door instances, set discoverAFDsAutomatically to false and specify only the instances to remove in afdsToProcessManually. Azure creates resources at the resource group level, so remove all Front Door instances in a resource group together.

Verifying the integration

Verify that the integration is working correctly.

Step 1: Sending a test request

Send a request to your Azure Front Door endpoint:

curl -i -X GET -L 'https://your-frontdoor-endpoint.azurefd.net/' -H 'x-test-header-1: test'

Step 2: Checking storage account logs

Verify that diagnostic settings are working by checking the storage account.

1. Open the Azure Storage account that stores the diagnostic logs.
2. Navigate to the insights-logs-frontdooraccesslog container.
3. Browse the file path to find recent log files.
4. Download and verify that valid logs are stored.

Step 3: Checking function app logs

Use Application Insights to query function app logs:

traces | summarize messages = make_list(message) by bin(timestamp, 1m) | project timestamp, messages

Step 4: Verifying in the Cequence platform

Log into the Cequence platform dashboard and verify that transaction data appears in the API traffic analysis section.

Known limitations

The integration has the following known limitations.

• The integration requires Azure CLI and Function Core Tools 4.
• You must configure diagnostic settings manually for each Front Door instance.
• Y1 VM (Consumption Plan) quota restrictions in certain Azure subscriptions can block deployment in some regions.
• The integration creates resources at the resource group level, which limits removal granularity to entire resource groups.
• Terraform state management requires appropriate Azure Storage Account permissions.

Configuration parameter details

The configuration includes the following key parameters.

• discoverAFDsAutomatically: When set to true, automatically discovers Azure Front Door instances.
• storeStateInCloud: When true, Terraform stores state files in Azure Storage Account.
• backendStorageAccount: Storage account name for Terraform state management.
• terraformAutoApprove: When true, automatically approves Terraform deployments.

Troubleshooting common issues

This section addresses common issues that occur during installation and operation of the integration.

Function App publishing failure (503 Site Unavailable)

If deployment fails with a 503 error during Function App publishing, the Azure service was temporarily unavailable. Re-run the deployment script after a short wait.

Diagnostic setting deletion timeout

If diagnostic setting operations fail with timeout errors, the failure typically indicates a transient Azure service issue. Perform a complete rollback and re-enable the integration.

Storage file share creation failure (403 Forbidden)

If storage file share creation fails with 403 Forbidden, verify that the service principal has appropriate permissions on the storage account and resource group.

Azure subscription quota restrictions

If Y1 VM creation fails due to quota restrictions, raise a support request with Microsoft to increase the quota for the region where creation failed. The script skips regions with quota restrictions and processes the other regions.

Enabling debug logging

For detailed troubleshooting, set the log level in your configuration:

"LOG_LEVEL": "DEBUG"