frostmoln_appgw_backend (Resource)

Manages a backend in an Application Gateway pool: one destination inside your VPC, named by its IP address.

Two things gate a backend, both deliberately:

1. The address must lie inside the gateway's own VPC range. Anything else is refused — without that check the gateway would be an open proxy.
2. Creating a backend does not open the path to it. The platform never edits your security groups implicitly. Use frostmoln_appgw_backend_authorization to add the one ingress rule, which is audited.

The backend API has no update operation, so every attribute forces a new resource.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Enacted and reconciled — every configurable attribute not listed below: the platform applies it, and a refresh reads the truth back.

Create-immutable — address, gateway_id, pool_id, port, source_id, source_kind, weight: the API has no update route for a backend — a change destroys and re-creates it.

Observed, not enacted — tags_all: keys set outside Terraform — in the portal, by the fm CLI, or stamped by the platform — appear only here and are kept on every apply, never removed.

Example Usage

# By address. It must lie inside the gateway's own VPC range.
resource "frostmoln_appgw_backend" "web_1" {
  gateway_id = frostmoln_application_gateway.edge.id
  pool_id    = frostmoln_appgw_backend_pool.web.id
  address    = "10.0.1.10"
  port       = 8080
  weight     = 1

  # Resource tags: your own metadata for search and filtering. Merged with
  # the provider's default_tags; changing them updates in place.
  tags = {
    env = "prod"
  }
}

# By instance: the platform resolves the VPC address itself, so `address` must
# not be set.
resource "frostmoln_appgw_backend" "web_2" {
  gateway_id  = frostmoln_application_gateway.edge.id
  pool_id     = frostmoln_appgw_backend_pool.web.id
  source_kind = "instance"
  source_id   = frostmoln_instance.web.id
  port        = 8080
}

# Creating a backend does NOT open the path to it. See
# frostmoln_appgw_backend_authorization.

Schema

Required

• gateway_id (String) The Application Gateway this backend's pool belongs to.
• pool_id (String) The backend pool this backend belongs to.
• port (Number) The port the backend listens on.

Optional

• address (String) The backend's IP address. It must lie inside the gateway's own VPC range; anything else is refused.

• source_id (String) Reserved. It will name the instance or load balancer whose address the platform resolves, once source_kind gains those values; it is refused today.

• source_kind (String) How the destination is named. address is the only value available: address is an IP inside your VPC.

  instance and load_balancer are reserved for naming a backend by an instance or load balancer id and letting the platform resolve its address. The platform refuses them today, so they are not offered here rather than being accepted and failing partway through an apply that has already built the gateway.

• tags (Map of String) Resource tags on the backend: your own key/value metadata for search and filtering, stored by the platform only and never pushed to the appliance. Changing them updates the backend in place (every other attribute replaces it): no config apply, no config_generation change. At most 32 keys including the tenant's default tags, which the platform merges in at create; a key is 1-64 bytes matching ^[a-zA-Z0-9]([a-zA-Z0-9._:/-]*[a-zA-Z0-9])?$, a value at most 256 bytes; keys beginning frostmoln_ or frostmoln- (any case) are reserved. Merged with the provider's default_tags on every write (a key set here wins). Holds only the keys this configuration sets; the full set is in tags_all.

• weight (Number) Relative share of traffic among the pool's backends. Omit to use the platform default.

Read-Only

• created_at (String) The creation timestamp.

• enabled (Boolean) Whether the backend is receiving traffic.

• id (String) The unique identifier of the backend.

• status (String) The backend's health as the gateway sees it: healthy, unhealthy, draining or unknown. An observation older than five minutes reads unknown rather than continuing to report what was last seen, so silence is never reported as healthy.

  ~> It reads unknown for every backend today. The ingest that reports observations is separate work that has not shipped, so nothing writes status or status_observed_at yet and every backend reads unknown whatever its real state. Do not build a health display, an alert or a lifecycle condition on this field until that lands.

• status_observed_at (String) When status was last observed, or null if it never has been. Null for every backend today — see status.

• tags_all (Map of String) Every tag the platform holds on this resource: the provider's default_tags, this resource's own tags (which win on a shared key), and any key set outside Terraform — in the portal, by the fm CLI, or stamped by the platform. Keys set outside Terraform appear only here and are kept on every apply, never removed.

• updated_at (String) The last update timestamp.