I was recently experimenting with infrastructure where Azure Front Door is deployed in front of Azure API Management and my focus was on how to secure that traffic to APIM is only coming from my Front Door instance, so here are some notes related to this setup.
APIM deployment models
If you want to use Front Door in front of APIM instance, keep in mind that Front Door requires that backends are accessible from public internet. That means that APIM can only be added as Front Door backend when:
- APIM is not deployed into a virtual network
- APIM is deployed into virtual network with external access type
In both cases, API Management gateway is accessible from the public internet.
If you deploy APIM into virtual network with internal access type (this is when API Management gateway is accessible only from within the virtual network), then you need to additionally provision Azure Application Gateway in front of APIM and use it as a backend endpoint in Azure Front Door.
APIM access restriction policies
Here is the official documentation about how to lock down the access to my backend to only Azure Front Door. Basically, for each requests sent to the backend, Front Door includes Front Door ID inside
If you want your APIM instance to only accept requests from Front Door, you can use the check-header policy to enforce that a request has a
X-Azure-FDID header and this header contains your Front Door ID. If the check fails, the policy terminates request processing and returns the HTTP status code and error message specified by the policy.
<check-header name="X-Azure-FDID" failed-check-httpcode="401" failed-check-error-message="Not authorized" ignore-case="false"> <value></value> </check-header>
frontDoorId is a APIM named value containing Front Door ID
The best place to add this policy would be at the Global level.
How to find Front Door ID?
You can find Front Door ID value under the Overview section from Front Door portal page.
If you have front-door az cli extension installed.
az network front-door show -n iac-fd -g iac-base-rg --query frontdoorId
If you can’t find
frontdoorId field in the response, make sure that you use latest version of
Alternatively you can use this command.
az resource show --api-version 2020-01-01 --resource-type Microsoft.Network/frontdoors --name iac-fd --resource-group iac-base-rg --query properties.frontdoorId
Note that you have to set
--api-version flag to
2020-01-01 version or newer.
Azure REST API
You can fetch the
frontdoorId from Front Door’s management API. The easiest way to do this is going to https://docs.microsoft.com/en-us/rest/api/frontdoorservice/frontdoor/frontdoors/get and click “Try it”. Note that you have to use API version
2020-01-01 or newer for this.
Network Security Group
If you deploy APIM into private virtual network (both for internal and external access types) and you only want to accept traffic from Front Door, you can use the service tag
AzureFrontDoor.Backend in your Network Security Group rules.
If you use
internal access type, then you configure
AzureFrontDoor.Backend rules at Network Security Group assigned to
agw-net subnet and in addition, you can restrict that
apim-net subnet only accept traffic from
agw-net subnet by configuring Network Security group assigned to
- Azure Front Door
- Backends and backend pools in Azure Front Door
- How do I lock down the access to my backend to only Azure Front Door?
- About API Management
- APIM named value
- APIM access restriction policies
- APIM check-header policy
- Network Security Group
- Create an ingress controller to an internal virtual network in Azure Kubernetes Service (AKS)
- How to use Azure API Management with virtual networks
- Integrate API Management in an internal VNET with Application Gateway
If you have any issues/comments/suggestions related to this post, you can reach out to me at firstname.lastname@example.org.
With that - thanks for reading!