Set Up a CDN Distribution using Terraform

overview a content delivery network (cdn) distributes your web content across geographically dispersed servers, reducing latency and improving load times for users worldwide this tutorial shows you how to automate the deployment of a cdn distribution using terraform infrastructure as code the flow of a web request through the cdn infrastructure begins with dns resolution, which directs a domain query to the nearest available cdn edge location upon receiving the request, the edge server terminates the tls connection to establish a secure, encrypted tunnel it then immediately checks its local cache for the requested content cache hit if the content is found in the cache, it is served instantly, minimizing latency cache miss if the content is not cached, the edge server fetches the data from the origin server cdn test example com , caches it for future requests, and serves it to the end user this process significantly reduces load on the origin server and ensures high availability and speed for the end user this tutorial demonstrates the following components component description configuration in this tutorial cloud dns manages dns zones for domains and subdomains on public name servers creates zone for example com and a record for cdn test example com certificate manager simplifies the management of secure sockets layer or transport layer security (ssl or tls) certificates for your domains issues and renews let's encrypt certificate cdn delivers content efficiently and securely to users across geographic locations configures distribution with routing rules and security settings target audience this tutorial is designed for devops engineers automating infrastructure deployment platform engineers building self service infrastructure developers integrating cdn into application delivery pipelines what you will learn by the end of this tutorial, you will have a fully automated cdn setup that includes dns zone management automated dns configuration for your domain tls certificate provisioning automatic certificate issuance and renewal via let's encrypt cdn distribution content delivery with configurable routing, caching, and security policies before you begin ensure that you have the following basic familiarity with terraform and dns concepts terraform version 1 0 or later https //developer hashicorp com/terraform/install and an ionos cloud account with api credentials you must have full control over a domain example example com and be prepared to change its nameservers at your registrar origin server already running and accessible example ip address used 10 0 0 15 it must respond to http or https requests on ports 80 and 443 cost considerations the following resources outlined in this tutorial are billable and will incur costs when used cdn bandwidth usage a fixed fee per cdn distribution waf is charged separately, if activated dns zone hosting dns zone is billed separately let's encrypt certificates free and browser trusted to set up cost alerts and estimate costs based on your traffic, see cost alert https //docs ionos com/cloud/set up ionos cloud/management/usage/cost alert and cost & usage https //docs ionos com/cloud/set up ionos cloud/management/usage/cost and usage procedure create a dns zone use terraform to create a dns zone note this resource defines the main dns zone example com managed by terraform resource "ionoscloud dns zone" "dns zone" { name = "example com" description = "managed by terraform" enabled = true } note the success message includes an option to copy the nameservers, which you can use to configure your domain at your registrar dns changes may take up to 48 hours to propagate and be effective verify that your nameservers in your domain registrar are correctly pointing to ns ic ui dns com ns ic ui dns de ns ic ui dns org ns ic ui dns biz configure an automatic certificate provider (acme) configure an acme provider example let’s encrypt cdn only accepts ssl or tls certificates from recognized certificate authorities (cas) resource "ionoscloud auto certificate provider" "cert provider" { name = "let's encrypt provider" email = "test certs\@ionos com" location = "de/fra" server = "https //acme dns server ionos com/directory" } note this resource sets the acme server, provider name, and notification email for certificate lifecycle events cdn only accepts ssl/tls certificates from recognized cas geotrust, let's encrypt (r5, r6, r10, r11, r12, r13, r14), and globalsign self signed certificates are not supported due to security requirements request an auto certificate issue a certificate for your cdn domain resource "ionoscloud auto certificate" "certificates" { provider id = ionoscloud auto certificate provider cert provider id common name = "cdn test example com" key algorithm = "rsa4096" name = "cdn certificate" } note terraform requests and manages the tls certificate, including automatic renewal deploy the cdn distribution create the cdn distribution, configure routing rules, and assign the certificate to your domain resource "ionoscloud cdn distribution" "cdn distributions" { domain = "example com" certificate id = "ionoscloud auto certificate certificates id" routing rules { scheme = each value scheme prefix = "/" upstream { host = "cdn test example com" caching = false waf = true sni mode = "origin" rate limit class = "r10" dns ttl = 60 } } } component description example domain the parent domain served by the cdn example com certificate id the certificate used to terminate https connections ionoscloud auto certificate certificates id routing rules defines path based routing and cdn behavior prefix the initial part of the url path used by the cdn to determine routing rules / scheme the protocol type for traffic between clients and cdn ( http , https , or both) http/https host the origin server from which the cdn fetches content cdn test example com caching controls whether cdn caches responses from the origin to improve performance false waf enables or disables the web application firewall (waf) to protect against threats false rate limit class sets limits on the number of requests allowed from a single ip address r10 sni mode specifies how the cdn handles server name indication (sni) for ssl or tls connections origin geo restrictions restricts or allows access to the cdn based on the user's geographic location de , fr , es upstream configures the origin host, caching, waf, and rate limiting policies expected result the cdn distribution is created with status active or provisioning the resulting ipv4 or ipv6 addresses must be configured as the new ip addresses for the a/aaaa records in the dns, replacing the origin server's ip addresses add a dns record create a dns a record to point cdn test example com to the cdn ip to link your cdn to your domain, you will need to create two specific dns records an a record for the ipv4 address and an aaaa record for the ipv6 address for more information, see create dns records https //docs ionos com/cloud/network services/cloud dns/dcd how tos/public zone/primary zone/create dns records note this resource sets the a or aaaa records for your cdn subdomain with a short ttl for rapid updates resource "ionoscloud dns record" "dns records" { zone id = ionoscloud dns zone dns zone id name = "cdn test example com" type = "a" content = "ionoscloud cdn distribution cdn distributions public endpoint v4" ttl = 60 }resource "ionoscloud dns record" "dns records" { zone id = ionoscloud dns zone dns zone id name = "cdn test example com" type = "aaaa" content = "ionoscloud cdn distribution cdn distributions public endpoint v6" ttl = 60 } the a or aaaa records point cdn test example com to the cdn edge server at ionoscloud cdn distribution cdn distributions public endpoint v4 or ionoscloud cdn distribution cdn distributions public endpoint v6 the 60 second ttl enables quick dns updates during testing increase this value in production to reduce dns query load verify the setup after deploying your resources, verify that your cdn setup is working as expected 1 initialize and apply terraform run the following commands in your project directory to initialize your terraform environment and apply your configuration, provisioning all resources terraform init terraform apply 2 check the dns resolution ensure that cdn test example com resolves to the correct ip address dig +short cdn test example com expected result the output must align with the terraform assigned cdn ip address used in your dns a/aaaa records final result now you can access the website https //cdn test example com and verify the benefits and performance of the configured cdn using any cdn performance testing tools the site should load securely with a valid certificate conclusion in this tutorial, you have set up a secure and automated cdn distribution for your domain using and terraform the provided terraform configuration creates and manages dns infrastructure automatically issues and renews tls certificates deploys the cdn distribution with custom routing rules this approach streamlines content delivery and ensures your site is ready to scale efficiently with cdn