Suggestion to protect azure web api to be accessed only by web apps

Question

We want to evolve the actual scenario, and the idea is to restrict the access to the web api to all except web apps. We don't have any VNet, Subnet or NSG. What is the best way to do this?

Answer 1

Hello @João Rego

If you want to restrict access to your Azure Traffic Manager, you can't do it directly on the Traffic Manager level, as it does not provide built-in features to restrict access.

You can set APIM public IP in accessing whitelist of your App service to make sure only APIM requests will be able to access your App Service. For how to set IP restriction , you may refer to this doc : https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#adding-and-editing-ip-restriction-rules-in-the-portal

Another options is to use Azure Application Gateway(WAF) instead Traffic Manager. You can allow specific IP addresses or IP ranges. This way, you can ensure that only your Web Apps or the allowed sources can access the Application Gateway.