Accept only traffic from a front-end service (API Management, Functions)

Overview

The following great article is helpful for us when configuring Azure Front Door in front of API Management to accept only traffic from Azure Front Door at API Management.

 

Integrate Azure Front Door with Azure API Management - Microsoft Tech Community

 

I would like to add information in case of using Application Gateway.

 

Query from customer

 

As always, I received the following query from my customer.

 

Now they are trying to use Azure API Management and Azure Functions for backend services to expose APIs. They plan to use Application Gateway as a web application firewall (WAF) in front of API Management. As they don't use either premium SKU or developer SKU, however, their API Management instance is not permitted to access VNet. In this situation, how do they configure each component behind Application Gateway to avoid accessing it from Internet directly?

I illustrated their requirements.

 

If they used premium SKU for both API Management and Azure Functions, they would not have to worry about that (as these services can access VNet when using Premium SKU). However, this customer uses Consumption SKU for Azure Functions, and Basic SKU for API Management.

 

Solution sample

Note: This is an example and is not the only one solution.

1. As Application Gateway is already configured for public access, assigned public IP address is used to communicate API Management instance. Therefore, NAT Gateway for communication with API Management instance is optional (not required).
2. Configure API Management instance to accept only traffic from Application Gateway instance. Along with source IP restriction, subscription key is also acceptable.
3. Configure Function app to accept only traffic from API Management instance. Along with source IP restriction, API host key and authentication are also acceptable.

 

1. Application Gateway

As I mentioned above, public IP address is already assigned to Application Gateway instance and the IP address is also used for outbound communication. Therefore, we don't have to do anymore. 

 

To accept only traffic from the Application Gateway instance, we can use ip-filter policy to restrict source IP in API Management. 

 

IP Filter policy

Azure API Management access restriction policies | Microsoft Docs

 

This policy should be defined in global scope as we have to check all traffics to the API Management instance.

 

Global scope

How to set or edit Azure API Management policies | Microsoft Docs

 

IP address(es) assigned to Application Gateway instance or NAT Gateway are filled in as permitted source IP address(es).

 

Policy configuration is as follows.

 

<policies>
    <inbound>
        <ip-filter action="allow">
            <address>xxx.xxx.xxx.xxx</address>
        </ip-filter>
    </inbound>
    <backend>
        <forward-request />
    </backend>
    <outbound />
    <on-error />
</policies>

 

We can also use original request IP addresses to filter requests through Application Gateway. For more details, check the following URL.  

Sample API management policy - Filter on IP Address when using Application Gateway - Azure API Management | Microsoft Docs

 

Enforcing using subscription key along with source IP address restriction would be much more strong restriction. When adding subscription key, configuration of HTTP header in Application Gateway is required.

 

3. Function app

 

In case of Function app, the following configuration should be done to avoid direct connection from the Internet.

• IP address restriction
  Configure to accept only traffic from Public IP address assigned to the API Management instance.
• Authentication
  Configure authentication in Function app to accept only accesses from resources in the same Azure AD tenant.
• Host key enforcement
  Authorization level should be set to function.

IP address restriction and authentication would be sufficient, using host key along with them would be much better. In this section, I describe how to configure IP address restriction and authentication in Function app. Both configurations are the same as in case of App Service.

 

a) IP address restriction

 

Settings > Networking > Incoming Traffic and click "Access restriction".

 

 

Click "+Add rule" on a tab whose name does not contain "scm".

 

b) Authentication

 

These steps are required to configure authentication in both Function app and API Management.

 

Function App

 

Settings > Authentication and click "Add identity provider".

 

Next, choose "Microsoft" for identity provider to authenticate identities against Azure AD.

 

In "App registration", you can choose either registering your application to Azure AD or picking the existing application. In "Restrict access", choose "Require authentication" and enable token store (enabled by default). And click the button "Next: Permissions >".

 

 

In "Microsoft Graph permissions", leave the default configuration and click "Add".

 

The following screen should appear after entry is completed. If you register application to Azure AD in the previous step, you can find client ID for the Function app. This client ID is required for authentication at API Management instance. (Note: this client ID has been already disabled.)

 

 

API Management

 

Security > Managed identities, and enable system-assigned managed identities of the API Management instance. we use this identity for authentication. 

 

 

Next, APIs > APIs and choose not operation scope but API scope, and add authentication-managed-identity policy to inbound pipeline. Configuration of this policy is as follows.

 

<policies>
    <inbound>
        <base />
        <authentication-managed-identity resource="0399d0f3-479a-41eb-8628-2cd2572d7b1d" />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

 

That's it!

 

4. Test

 

When invoking Function app directly, the app returns 403 due to IP address restriction.

 

When calling an API backed by Function app via API Management (with IP address restriction disabled on API Management), the API returns 200 with response body.

Note: you can pass subscription key to API Management in the form of query parameter (subscription-key) or HTTP header (Ocp-Apim-Subscription-Key).

Next, when calling the API directly with IP address restriction enabled on API Management, it returns 403 .

At last, when calling the API via Application Gateway, it returns 200 with response body. (in this case, HTTP instead of HTTPS is used for testing purpose.)

 

How about Azure Front Door?

Summary

 

My customer understood my proposal mentioned above, and they followed my proposal to configure their environment. In case of Azure Front Door, cost for IP address restriction is expensive as API Management ip-filter policy accepts only IP address(es) instead of service tag AzureFrontDoor.Backend. Simply using X-Azure-FDID is less expensive but this does not work for some cases.

If API Management instance were deployed in VNet, we could use Private Link, which is available in Azure Front Door Premium SKU, to connect Application Gateway in front of API Management.

However, Private Link for Application Gateway is not available as of October 6, 2021 even though we can choose Application Gateway as a destination of Private Link (see the screenshot above). If Private Link for Application Gateway is available, better option is to configure Private Link from Front Door to Application Gateway and deploy API Management instance behind internal Application Gateway.