About the private endpoint function.

Question

Without giving the subnet to APIM, is it possible to access AKS in our Vnet using a private endpoint from APIM?

We know it's best to have API Management inside the Vnet, but premium skus are too expensive for us. So, I am trying to implement the architecture with the API Management Basic sku by using Private Endpoint. Is there any good way?

Answer 1

Your conclusion is correct. APIM cannot access any resource within the VNET.

You have the option to work around this though. Let the external callers connect to APIM first. Then let APIM connect to the AKS API's via the application gateway. You can restrict the application gateway to only accept calls from APIM. So, the flow would look like this:

external caller --> API Management --> Application Gateway --> AKS

We have set this up for one of our customers. In our situation, we were not using AKS, but Azure Functions.

This setup provides you with a secure access to your AKS environement, without the costs of APIM premium.

Answer 2

Hi,
Yes, your ask is possible. But the Private endpoint to APIM is in preview.

Reference: https://learn.microsoft.com/en-us/azure/api-management/private-endpoint

Regards,
Karthik Srinivas