# Azure Front Door System Identity using Terraform

Identity in Azure Front Door is still in preview and you cannot use the AzureRM provider to configure it. This blocks users from being able to link services such as Key Vault using IaC.

Although AzureRM cannot do this, we can utilise the AzAPI provider to configure the System Identity. AzAPI utilises JSON to configure settings in a resource. We can select the API version, giving us control to use an API version in preview that has Identity available.

## Configure the Provider

First, add the AzAPI provider to your Terraform config:

```json
terraform {
  backend "azurerm" {}
  required_version = "***"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "***"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 1.0"
    }
  }
}

provider "azurerm" {
  features {}
}

provider "azapi" {}
```

## Add the Identity Resource

We will be utilising the **azapi\_update\_resource** to update an existing Azure Front Door instance to enable System Identity. The resource block will look like this:

```json
resource "azapi_update_resource" "frontdoor_system_identity" {
  type        = "Microsoft.Cdn/profiles@2023-02-01-preview"
  resource_id = azurerm_cdn_frontdoor_profile.main.id
  body = jsonencode({
    "identity" : {
      "type" : "SystemAssigned"
    }
  })
}
```

Replace the following:

**resource\_id** - point this to the Azure Front Door profile you want to set a System Identity

## Add an Output for System Identity

There are resources, such as Key Vault, where you need the ID of the created System Identity to configure access policies. For this, we need to add the following output to the bottom of the resource block:

```json
  response_export_values = ["identity.principalId", "identity.tenantId"]
```

To call the outputs, you just need to use the following:

```json
jsondecode(azapi_update_resource.frontdoor_system_identity.output).identity.tenantId

jsondecode(azapi_update_resource.frontdoor_system_identity.output).identity.principalId
```

Once you are ready, run **Terraform Init**, and **Terraform Plan** to see what will happen before deployment.

%%[buymeacoffe-butyellow]