Securing Azure API and Multiple Azure Services with VNet

Question

How can I secure my Azure API and its multiple Azure services by using VNet? Currently, my API allows users to upload and download files in containers within an Azure Storage account. The Azure services I am using include APIM (with an Azure Function as the API), 2 separate Azure Functions (one for developing SAS tokens and another for uploading files), and an Azure Storage account. Even though the system works, security is a concern since most of the Azure services I use are public. I am considering using VNet to restrict traffic within my API from accessing these Azure services, but I am unsure how to implement it. Can anyone provide guidance on how I can achieve this?

Answer 1

Hello,

There is a high view to implement VNet integration to restrict traffic in your case :

• Create the virtual Network
• Create a NSG to define the rules to restrict traffic as you need
• Asssociate the NSG to the subnet
• Implement VNet integration or private endpoint features on API, Function and Storage Services on

More info on how to ingrate Azure Services with VNet :

https://learn.microsoft.com/en-us/azure/virtual-network/vnet-integration-for-azure-services

You can also consider implement Azure Policy to further enhance security.

If this answer helped, please mark it as accepted for other users with similar question to be able to find this topic.

Regards