Manage CDN resources with Terraform v0

Documentation Index

Fetch the complete documentation index at: https://gcore.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

Workflow

terraform plan

terraform apply

​

Manage origin groups

​

Create an origin group with host origins

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_origingroup" "example" {
  name     = "example-group"
  use_next = true

  origin {
    source  = "origin.example.com"
    enabled = true
  }

  origin {
    source  = "backup.example.com"
    enabled = true
    backup  = true
  }
}

3. Configure the origin group.

• Specify name — the display name in the Customer Portal.
• Set use_next:
  • true — if the first active origin fails, the CDN tries the remaining active origins in order, then falls back to backup origins.
  • false — if the first active origin fails, the CDN skips remaining active origins and immediately tries backup origins.
• For each origin block:
  • Specify source — the domain or IP of the origin server. The domain must resolve in DNS.
  • Set enabled = true to make the origin active.
  • (optional) Add backup = true to designate the origin as a backup.
  • (optional) Add host_header_override to send a custom Host header to this specific origin.
• (optional) Add proxy_next_upstream — a set of conditions that trigger failover. Accepted values: error, timeout, invalid_header, http_403, http_404, http_429, http_500, http_502, http_503, http_504.

​

Create an origin group with an S3 origin

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_origingroup" "s3_example" {
  name     = "s3-example-group"
  use_next = false

  origin {
    enabled     = true
    origin_type = "s3"

    config {
      s3_type              = "amazon"
      s3_bucket_name       = "my-bucket"
      s3_region            = "us-east-1"
      s3_access_key_id     = "AKIAIOSFODNN7EXAMPLE"
      s3_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    }
  }
}

3. Configure the S3 origin.

• Set origin_type = "s3" in the origin block.
• In the nested config block:
  • Set s3_type: "amazon" for Amazon S3, or "other" for S3-compatible storage.
  • Specify s3_bucket_name.
  • Specify s3_region — required when s3_type is "amazon".
  • Specify s3_storage_hostname — required when s3_type is "other".
  • Specify s3_access_key_id and s3_secret_access_key.

​

Add S3 authentication at the group level

resource "gcore_cdn_origingroup" "s3_auth_example" {
  name     = "s3-auth-group"
  use_next = false

  origin {
    source  = "my-bucket.s3.amazonaws.com"
    enabled = true
  }

  auth {
    s3_type              = "amazon"
    s3_bucket_name       = "my-bucket"
    s3_region            = "us-east-1"
    s3_access_key_id     = "AKIAIOSFODNN7EXAMPLE"
    s3_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  }
}

​

Manage CDN resources

​

Create a basic CDN resource

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origingroup.example.id
  origin_protocol = "HTTPS"
}

3. Configure the CDN resource.

• Specify cname — the custom domain for the CDN resource (e.g., cdn.example.com). After applying, create a CNAME DNS record pointing this domain to the value shown in gcore_cdn_client_config.cname or in the Portal setup guide.
• Specify either origin_group (ID of an origin group) or origin (a single origin domain or IP). Use origin_group for multi-origin or failover setups.
• Set origin_protocol:
  • "MATCH" — CDN uses the same protocol as the client request.
  • "HTTP" — CDN always requests the origin over HTTP.
  • "HTTPS" — CDN always requests the origin over HTTPS.
• (optional) Add secondary_hostnames — a set of additional CNAMEs served by this resource.
• (optional) Add description — a free-text label visible in the Portal.
• (optional) Set active = false to suspend the resource. Defaults to true.

​

Configure delivery options

• allowed_http_methods — GET, HEAD, OPTIONS, POST are allowed.
• edge_cache_settings — follows origin Cache-Control headers; caches for 4 days if no cache header is present.
• response_headers_hiding_policy — configured with common headers listed, but the policy is disabled by default.
• sni — dynamic SNI mode; the CDN uses the origin hostname as the SNI value.
• stale — serves stale content on error and updating conditions.
• tls_versions — all TLS versions listed; restriction is disabled.

1. Open the main.tf file.
2. Add an options block inside the gcore_cdn_resource block:

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origingroup.example.id
  origin_protocol = "HTTPS"

  options {
    edge_cache_settings {
      enabled = true
      value   = "345600s"
      custom_values = {
        "403" = "1000s"
        "404" = "50s"
      }
    }

    gzip_on {
      enabled = true
      value   = true
    }

    allowed_http_methods {
      enabled = true
      value   = ["GET", "HEAD"]
    }

    browser_cache_settings {
      enabled = true
      value   = "3600s"
    }

    cors {
      enabled = true
      value   = ["*"]
    }

    redirect_http_to_https {
      enabled = true
      value   = true
    }
  }
}

​

Add secondary hostnames

resource "gcore_cdn_resource" "multi_domain" {
  cname               = "cdn.example.com"
  origin_group        = gcore_cdn_origingroup.example.id
  origin_protocol     = "HTTPS"
  secondary_hostnames = ["cdn2.example.com", "cdn3.example.com"]
}

​

Manage SSL certificates

​

Issue a Let’s Encrypt certificate automatically

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_sslcert" "example" {
  name      = "example-cert"
  automated = true
}

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origingroup.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = true
  ssl_data        = gcore_cdn_sslcert.example.id
}

3. Configure the SSL certificate.

• Specify name — must be unique within the account.
• Set automated = true to request a Let’s Encrypt certificate.
• In the CDN resource, set ssl_enabled = true and reference the certificate ID with ssl_data.

​

Upload a custom SSL certificate

resource "gcore_cdn_sslcert" "custom" {
  name        = "my-custom-cert"
  cert        = file("cert.pem")
  private_key = file("key.pem")
}

resource "gcore_cdn_resource" "example" {
  cname           = "cdn.example.com"
  origin_group    = gcore_cdn_origingroup.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = true
  ssl_data        = gcore_cdn_sslcert.custom.id
}

• cert — the full certificate chain in PEM format. Include the server certificate and any intermediate certificates.
• private_key — the private key in PEM format.
• (optional) Set validate_root_ca = true to verify that the certificate chain is signed by a trusted CA.

​

Manage CA certificates for origin verification

​

Upload a CA certificate

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_cacert" "example" {
  name = "my-origin-ca"
  cert = file("ca.pem")
}

• Specify name — must be unique within the account.
• Specify cert — the CA certificate in PEM format. Each certificate in the chain must end with a newline character.

​

Enable origin SSL verification

resource "gcore_cdn_sslcert" "client_cert" {
  name        = "client-cert"
  cert        = file("client.pem")
  private_key = file("client-key.pem")
}

resource "gcore_cdn_cacert" "origin_ca" {
  name = "origin-ca"
  cert = file("origin-ca.pem")
}

resource "gcore_cdn_resource" "secure_example" {
  cname             = "cdn.example.com"
  origin_group      = gcore_cdn_origingroup.example.id
  origin_protocol   = "HTTPS"
  proxy_ssl_enabled = true
  proxy_ssl_ca      = gcore_cdn_cacert.origin_ca.id
  proxy_ssl_data    = gcore_cdn_sslcert.client_cert.id
}

• proxy_ssl_enabled = true — enables SSL verification of the origin.
• proxy_ssl_ca — the ID of the CA certificate used to verify the origin’s certificate.
• proxy_ssl_data — the ID of a client certificate (must be a manually uploaded certificate, not automated).

​

Manage CDN rules

​

Create a rule

1. Open the main.tf file. It must contain the gcore_cdn_resource block for the resource the rule will be attached to.
2. Copy the code below and customize the values:

resource "gcore_cdn_rule" "images" {
  resource_id = gcore_cdn_resource.example.id
  name        = "PNG images"
  rule        = "/images/*.png"
  rule_type   = 0

  options {
    edge_cache_settings {
      enabled = true
      value   = "86400s"
    }
  }
}

3. Configure the rule.

• Specify resource_id — reference the CDN resource using its Terraform ID.
• Specify name — the display name in the Customer Portal.
• Specify rule — the path pattern. Must start with /. Supports glob wildcards (*, **) for rule_type = 0.
• Set rule_type:
  • 0 — glob pattern (e.g., /images/*.png).
  • 1 — regular expression (must start with ^/).
• (optional) Add an options block with the same options available on the CDN resource.
• (optional) Set active = false to disable the rule without deleting it.
• (optional) Set weight — rule execution order from lowest to highest. Rules with the same weight execute in definition order.
• (optional) Set origin_group — override the origin group for requests matched by this rule.
• (optional) Set origin_protocol — override the origin protocol for requests matched by this rule.

​

Manage rule templates

​

Create a rule template

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_rule_template" "static_assets" {
  name      = "static-assets-template"
  rule      = "/static/*"
  rule_type = 0

  options {
    edge_cache_settings {
      enabled = true
      value   = "604800s"
    }

    gzip_on {
      enabled = true
      value   = true
    }
  }
}

3. Configure the rule template.

• (optional) Specify name — the template display name.
• Specify rule — the path pattern for the template.
• Set rule_type — 0 for glob, 1 for regular expression.
• Add an options block with the delivery options to apply.
• (optional) Set weight — the execution priority when applied to a resource.
• (optional) Set override_origin_protocol — override the origin protocol for requests matched by the template.

​

Apply presets

​

Apply a preset to a CDN resource

1. Find the available preset IDs by querying the Gcore API:

curl -H "Authorization: APIKey your-api-token" https://api.gcore.com/cdn/presets

2. Open the main.tf file with the Gcore provider configuration.
3. Copy the code below and customize the values:

resource "gcore_cdn_applied_preset" "live_streaming" {
  object_id = gcore_cdn_resource.example.id
  preset_id = 52
}

• Specify object_id — the ID of the CDN resource or rule to apply the preset to.
• Specify preset_id — the ID of the preset returned by the API. Currently available presets:
  • 52 — LIVE STREAMING.

​

Manage account configuration

​

Read and update account CDN settings

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below:

resource "gcore_cdn_client_config" "account" {
  utilization_level = 100
}

3. Configure the resource.

• (optional) Set utilization_level — CDN traffic usage limit in gigabytes. The only writable field.

• cname — the CDN CNAME zone for the account (e.g., cl-abc123.gcdn.co). All CDN resource custom domains must have a CNAME record pointing to this value.
• id — the account ID.
• created and updated — timestamps of account creation and last update.
• auto_suspend_enabled — whether inactive CDN resources are automatically suspended.
• cdn_resources_rules_max_count — maximum number of rules per CDN resource.
• use_balancer — whether custom balancing is enabled.
• service — status of the CDN service (enabled, status, last update time).

output "cdn_cname_zone" {
  value = gcore_cdn_client_config.account.cname
}

​

Manage origin shielding

​

Enable origin shielding

1. Find the available shielding PoP IDs:

curl -H "Authorization: APIKey your-api-token" https://api.gcore.com/cdn/shieldingpop_v2

• 171 — Singapore (SG1)
• 172 — Ashburn, USA
• 198 — Amsterdam and Frankfurt

2. Open the main.tf file with the Gcore provider configuration.
3. Copy the code below and customize the values:

resource "gcore_cdn_originshielding" "example" {
  resource_id   = gcore_cdn_resource.example.id
  shielding_pop = 171
}

• Specify resource_id — the ID of the CDN resource to enable shielding for.
• Specify shielding_pop — the PoP ID from the API response.

​

Disable origin shielding

​

Configure CDN logs (Logs Uploader)

​

Create a log policy

1. Open the main.tf file with the Gcore provider configuration.
2. Copy the code below and customize the values:

resource "gcore_cdn_logs_uploader_policy" "example" {
  name   = "my-log-policy"
  fields = [
    "timestamp",
    "clientIP",
    "uri",
    "status",
    "responseSize",
    "cachestatus"
  ]
  rotate_interval_minutes = 5
  include_shield_logs     = false
}

3. Configure the log policy.

• (optional) Specify name. Defaults to "Policy".
• Specify fields — the list of log fields to include. Available fields include timestamp, clientIP, uri, status, responseSize, cachestatus, and others.
• (optional) Set rotate_interval_minutes — how often to create a new log file, in minutes. Default: 5.
• (optional) Set rotate_threshold_lines — rotate log file after this many lines. Default: 0 (disabled).
• (optional) Set rotate_threshold_mb — rotate log file after this size in megabytes.
• (optional) Set include_shield_logs = true to include requests served by origin shielding PoPs.
• (optional) Set include_empty_logs = true to upload log files even when empty.
• (optional) Specify file_name_template — template for log file names. Default: "{{YYYY}}/{{MM}}/{{DD}}/{{HH}}/{{mm}}".
• (optional) Specify field_separator — character separating fields. Default: space.
• (optional) Specify field_delimiter — character wrapping field values. Default: ".
• (optional) Specify date_format — format string for date fields.
• (optional) Specify format_type — output format type.
• (optional) Set retry_interval_minutes — minutes between retry attempts for failed uploads. Default: 60.

​

Create a log upload target

1. Open the main.tf file.
2. Copy the code below and customize the values:

resource "gcore_cdn_logs_uploader_target" "example" {
  name = "my-log-target"

  config {
    s3_gcore {
      endpoint          = "s3.gcore.com"
      region            = "s-ed1"
      bucket_name       = "my-logs-bucket"
      access_key_id     = "your-access-key-id"
      secret_access_key = "your-secret-access-key"
      directory         = "cdn-logs/"
    }
  }
}

3. Configure the log target.

• (optional) Specify name. Defaults to "Target".
• (optional) Specify description.
• Add a config block with exactly one of the following backend blocks:

resource "gcore_cdn_logs_uploader_target" "amazon_s3" {
  name = "amazon-s3-target"

  config {
    s3_amazon {
      bucket_name       = "my-logs-bucket"
      region            = "us-east-1"
      access_key_id     = "AKIAIOSFODNN7EXAMPLE"
      secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
      directory         = "cdn-logs/"
    }
  }
}

resource "gcore_cdn_logs_uploader_target" "http" {
  name = "http-target"

  config {
    http {
      content_type = "json"

      upload {
        url    = "https://logs.example.com/upload"
        method = "POST"
      }

      auth {
        type = "token"
        config {
          header_name = "Authorization"
          token       = "Bearer your-token"
        }
      }
    }
  }
}

​

Create a log upload configuration

1. Open the main.tf file.
2. Copy the code below and customize the values:

resource "gcore_cdn_logs_uploader_config" "example" {
  name              = "my-log-config"
  policy            = gcore_cdn_logs_uploader_policy.example.id
  target            = gcore_cdn_logs_uploader_target.example.id
  enabled           = true
  for_all_resources = false
  resources         = [gcore_cdn_resource.example.id]
}

3. Configure the log config.

• Specify name — the display name.
• Specify policy — the ID of the log policy.
• Specify target — the ID of the log target.
• (optional) Set enabled = false to pause log uploading without deleting the config. Defaults to true.
• Set for_all_resources:
  • true — upload logs for all CDN resources in the account.
  • false — upload logs only for the resources listed in resources.
• Specify resources — a list of CDN resource IDs. Required when for_all_resources = false.