Terraform-Driven Azure Application Gateway Deployments with WAF and Path-Based Routing

Application Gateway is a central element for building scalable, reliable, and secure web front ends in Azure. It is a web traffic load balancer that manages traffic to web applications and bases routing decisions on factors that include round-robin, cookie-based sessions, and more. When provisioned through Terraform, the entire definition, preview, and deployment of the infrastructure becomes declarative and versioned.

Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed.

This article covers the authoritative patterns for creating an Azure Application Gateway with an Azure Web Application Firewall v2 policy, implementing path-based routing, using the Azure Verified Modules framework, and operating the gateway with diagnostics and best practices.

Core Components of a Terraform Application Gateway Quickstart

A typical quickstart that uses Terraform to create an Azure Application Gateway with an Azure Web Application Firewall v2 policy provisions more than the gateway itself.

resource group
virtual network
subnet within the virtual network
public IP address
WAF policy with custom rules to block traffic from a specific IP address

The code creates these supporting resources alongside the gateway to form a complete front end. Terraform will create all resources in the correct order, handling dependencies automatically.

The Standard v2 SKU is used in this example. Application Gateway frontend now supports dual-stack IP addresses (Preview).

Key capabilities of the Application Gateway itself include:

Load Balancing: It distributes incoming network traffic across multiple servers to ensure even utilization and prevent overloading any single server. This results in better performance and fault tolerance.
Web Application Firewall (WAF): Azure Application Gateway comes with a built-in web application firewall that helps protect web applications from common web exploits and vulnerabilities

WAF Policy and Secure Front End Definition

In the WAF quickstart pattern, a key component of creating scalable, reliable, and secure web front ends in Azure is Application Gateway paired with a WAF v2 policy.

The WAF policy is defined as a separate resource and attached to the gateway. Custom rules can be added to block traffic from a specific IP address. This approach separates policy definition from gateway configuration and allows reuse across multiple gateways.

The Terraform configuration creates the resource group, virtual network, subnet, public IP address, and a WAF policy with custom rules to block traffic from a specific IP address. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.

The following table summarizes the core resources in the quickstart.

Resource	Purpose
Resource Group	Container for all Azure resources
Virtual Network	Network isolation for gateway
Subnet	Address space for Application Gateway instances
Public IP Address	Frontend IP for client access
WAF Policy	Web Application Firewall rules and custom blocks
Application Gateway	Layer 7 load balancer with WAF v2

Path-Based Routing Architecture with Terraform

Azure Application Gateway is a Layer 7 load balancer that lets you route HTTP and HTTPS traffic based on URL paths, hostnames, and other request attributes. Path-based routing is one of its most useful features - you can send /api/* requests to your API backend and /* to your web frontend, all through a single public IP and SSL certificate.

Deploying Application Gateway through the portal is a maze of blades and dropdowns. Terraform gives you a declarative way to define the whole thing - listeners, backend pools, routing rules, health probes, and path maps - in code that you can review and version.

Architecture Overview

Here is what we are building:

A client connects to Application Gateway. The gateway evaluates Path-Based Rules and routes:

/api/* to API Backend Pool
/static/* to Static Content Pool
Default to Web App Pool

The API Backend Pool connects to API App Service. The Static Content Pool connects to Storage Account. The Web App Pool connects to Web App Service.

Application Gateway has a lot of nested configuration blocks. The full Terraform configuration includes:

Frontend IP configuration
Backend address pools
Backend HTTP settings
Health probes
Listeners
Path-based routing rules and path maps
Routing rules

The Application Gateway can pull certificates directly from Key Vault, which simplifies rotation.

Enable diagnostic logging to Log Analytics. Application Gateway access logs are invaluable for debugging routing issues and analyzing traffic patterns.

Size your subnet appropriately. Application Gateway v2 can scale to many instances, and each instance needs IP addresses from the subnet.

Set the pickhostnamefrombackend_address setting to true when your backends are App Services. App Services require the correct Host header to route traffic to the right app.

Terraform Configuration Patterns and Best Practices

The following Terraform configuration creates the resources described above. Each resource includes proper tagging, security settings, and follows Azure best practices.

This downloads the Azure provider plugin and initializes the backend.

Always review the plan before applying. Check that only the expected resources will be created.

Managing Azure resources with Terraform brings consistency, version control, and automation to your infrastructure. The configurations in this guide follow production best practices and can be extended to match your specific requirements. Start with these foundations and iterate as your infrastructure needs evolve.

Configuration considerations for production readiness:

Tagging is applied consistently across resources
Security settings are defined at creation time
Diagnostic settings are configured to ensure robust monitoring and troubleshooting
Public IP address is created explicitly for the Application Gateway
Backend pools, health probes, and listeners are defined declaratively

After applying, verify your resources are running correctly:

Validate these resources within the Azure portal to confirm that everything is functioning as expected
Review access logs in Log Analytics for traffic patterns
Test path-based routing rules with representative requests

The configuration is verbose, but each section has a clear purpose, and once it is in place, adding new paths and backends is a straightforward extension of the existing pattern.

Azure Verified Modules for Application Gateway

When using Terraform to deploy Azure resources, you can make use of a Terraform module to define and configure the Azure Application Gateway.

Azure Application Gateway is a load balancer that enables you to manage and optimize the traffic to your web applications. Here is a summary page about using an Azure Application Gateway Terraform module.

Important

As the overall AVM framework is not GA (generally available) yet - the CI framework and test automation is not fully functional and implemented across all supported languages yet - breaking changes are expected, and additional customer feedback is yet to be gathered and incorporated. Hence, modules MUST NOT be published at version 1.0.0 or higher at this time.

All module MUST be published as a pre-release version (e.g., 0.1.0, 0.1.1, 0.2.0, etc.) until the AVM framework becomes GA.

However, it is important to note that this DOES NOT mean that the modules cannot be consumed and utilized. They CAN be leveraged in all types of environments (dev, test, prod etc.). Consumers can treat them just like any other IaC module and raise issues or feature requests against them as they learn from the usage of the module. Consumers should also read the release notes for each version, if considering updating to a more recent version of a module to see if there are any considerations or breaking changes etc.

Azure Application Gateway is a Layer-7 load balancer service provided by Microsoft Azure.

Using an AVM module provides a standardized interface for the nested configuration blocks required by Application Gateway while keeping the underlying resource definition maintainable.

Monitoring, Diagnostics, and Operational Guidance

Configure Azure Monitor, Log Analytics, and alerts with Terraform for comprehensive cloud observability. Step-by-step guide with code examples and best practices.

Set up monitoring from day one:

Enable diagnostic logging to Log Analytics
Configure diagnostic settings to ensure robust monitoring and troubleshooting
Application Gateway access logs are invaluable for debugging routing issues and analyzing traffic patterns

Operational guidance from path-based routing implementations:

Size your subnet appropriately. Application Gateway v2 can scale to many instances, and each instance needs IP addresses from the subnet
Set the pickhostnamefrombackend_address setting to true when your backends are App Services
Pull certificates from Key Vault to simplify rotation
Review the execution plan before applying to ensure only expected resources will be created

The following table captures common operational checks.

Check	Reason
Subnet size	Supports scale-out of Application Gateway v2 instances
Host header setting	Required for App Service backends
Diagnostic settings	Enables monitoring and troubleshooting
WAF policy rules	Provides protection against web exploits

Conclusion

Azure Application Gateway with path-based routing gives you fine-grained control over how traffic reaches your backends. By defining it all in Terraform - the networking, backend pools, path maps, probes, and routing rules - you get a repeatable and reviewable infrastructure definition.

The combination of a declarative Terraform workflow with Application Gateway’s Layer 7 capabilities produces a production-ready front end that can be versioned, peer-reviewed, and reproduced across environments. WAF v2 policies provide a built-in layer of protection while custom rules allow precise traffic control. Path-based routing consolidates multiple services behind a single public IP and SSL certificate, simplifying client access and certificate management.

The configuration is verbose, but each section has a clear purpose, and once it is in place, adding new paths and backends is a straightforward extension of the existing pattern. Using Terraform modules from the Azure Verified Modules framework accelerates adoption while acknowledging that the AVM framework is not GA yet and breaking changes are expected. Consumers should treat modules as usable pre-release artifacts, read release notes before upgrading, and maintain diagnostic logging and subnet sizing best practices to support reliable operation at scale.

Managing Azure resources with Terraform brings consistency, version control, and automation to your infrastructure. Start with these foundations and iterate as your infrastructure needs evolve.