Azure APIM : Target system to whitelist Azure APIM traffic

Question

Hi,

The target api system wants to whitelist calls only from Azure API Management.
My APIM is inside virtual network.

What is the correct Header of Azure APIM that I should provide to the target api system, so that it can be whitelisted ?

I guess it should be something X-Forwarded or X-Origin headers host headers.
Because X-Forwarded ip address cannot be the right solution as the outbound ip address from azure apim wil depend on the available ip address in the subnet.
It will not be constant forever.

What is the right recommendation ?

Answer 1

@Amit-J I assume your APIM is in VNET, and backend API is outside VNET (internet facing), and you want to allow-list only calls from APIM. APIM uses public IP address for a connection outside VNET/peered VNET and internal IP addresses from the subnet are only used for within the VNET or a peered VNET. Refer IP addresses for outbound traffic for more info as mentioned below:

As per Changes to the IP addresses, public IP address is static with few exceptions, and you would need to adjust allow-list in target backend API accordingly. It is also possible to route and override public IP of APIM with NVA's IP and refer SO thread and comment from our product team. I hope this helps but feel free to add a comment for any questions or clarify if my assumptions are incorrect.

Answer 2

Hi @Amit-J ,

Thanks for posting your query in Q&A forum.

The ideal way to achieve your goal is to add the target API to the same vnet where the APIM is present. When the target API and APIM are present in same vnet, then there is no need to whitelist the IP adressess. If you would like to go with the headers approach, you can set a custom HTTP header in the outbound policy in APIM and validate it at the target api side.

https://learn.microsoft.com/en-us/azure/api-management/api-management-transformation-policies#SetHTTPheader

Hope this helps! Feel free to reach out to me if you have any questions or concerns.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.