How to implement security across internet facing APIs and organization’s internal APIs that are hosted in on-premise and Azure cloud?

by Kaviraju

You must have come across the scenario in your IT solution where customers have asked you to implement security layer across internet facing applications and organization’s internal applications. Main challenges we generally overcome are like below…

  • Internal and external apps must be well differentiated (not mixed-up) in such a way that organization’s internal APIs must not be accessible from outside network (expect through customer’s LAN), and hence must be protected from external people and cyber attacks.
  • External APIs (public or internet facing APIs – like customer or supplier connectivity modules) must be able to access securely over internet, which must be restricted to authorized users only.

There’re couple of common questions which most of your customers ask are :

  1. How do we protect the Internet-facing public endpoint of API Management?
  2. How can we selectively expose some API’s externally whilst keeping all other API’s internal to organization?

In Microsoft Azure cloud, security can be easily implemented for internet facing APIs and organization’s internal APIs with the use of Azure Application Gateway and Azure API Management. Most importantly, we should allow authorized people only (customer or supplier) to access internet facing APIs, whereas internal APIs must be made accessible to your organization employees within LAN network only. Single instance of Azure Application Gateway and Azure API Management will help you to implement such robust security layer across both the type of APIs. Let us discuss both of them in detail first, and then followed by their integration methodology to achieve the target.

What is Azure Application Gateway (AGW)?

Azure Application Gateway (AGW) is combination of web traffic manager and load balancer that helps you to manage traffic to you web applications, which are hosted inside Azure and/or on-premise.

Application Gateway works at Application Layer (OSI Layer 7), and specifically with HTTP/S including Web Sockets.

Traditional load balancers operate at the transport layer (OSI layer 4 – TCP and UDP) and route traffic based on source IP address and port, to a destination IP address and port. It supports secure socket layer termination security which makes a more secure way of load balancing and also supports HTTP-based load balancing and creates sessions on the basis of cookies.

Main features of AGW

1) Web traffic load balancer: It enables WebSocket and HTTPS protocols thereby enabling full-duplex communication between client and server using TCP connection. It handles balancing of load across pool of resources (ex: VM servers) in backend based on configurations made in AGW. The backend pool instances can be Azure Virtual Machines or instances in a virtual machine scale set. Traditional load balancers operate at the Transport Layer (OSI layer 4) and route traffic based on source IP address and port, to a destination IP address and port.

2) Routing with URI path and Host headers:  It allows you to manage traffic across backend pools on the basis of URLs. In other words; it differentiates the traffic by URL and host header names. For example, you can route traffic based on the incoming URL. If /images are in the inbound URL, you can route traffic to a specific set of servers (or pool) configured for images. If /video is in the URL, that traffic is routed to another pool. This is depicted in below diagram.

Figure #1: Routing in AGW

3) Security: It supports a Web Application Firewall (WAF) which enables filtering of the traffic and protection with Zone Redundancy feature. Big advantage of WAF is that, it protects your workload from common exploits like SQL injection attacks or cross-site scripting attacks. Also note that, AGW acts as a reverse-proxy service.

4) Sticky Session Supported:  it supports traffic based on the cookies. When you stop using a web app and re-login into the web app after some time, then the AGW diverts your request (or traffic) to the same web server (that was used earlier) as per the cookies for quick connection and faster delivery of services.

5) TLS/SSL termination/SSL Offload: TLS/SSL termination can be useful to allow unencrypted traffic between AGW and backend servers saving some of processing load needed to encrypt and decrypt said traffic. However, sometimes unencrypted communication to the servers is not acceptable because of security requirements, compliance requirements, or application may only accept a secure connection. In these situations, Application Gateway also supports end-to-end TLS/SSL encryption.

What is Azure API Management (API-M)?

1) It allows you to manage APIs across clouds and on-premises: Means; deploy the API gateways side-by-side with the APIs hosted in other clouds and on-premises to optimize API traffic flow. Meet security and compliance requirements while enjoying a unified management experience and full observability across all internal and external APIs.

Figure #2: Single API-M to manage APIs across clouds and on-premises (both internal and external internet facing APIs)

2) Enables single HTTPS endpoint: API Management is a wonderful service in Azure for abstracting your back-end services (many API services) and exposing those API’s via a single HTTPS endpoint.

3) APIs accessible only from within your LAN: The API Management service can be configured in a Virtual Network in internal mode, which makes your APIs accessible only from within your LAN (or Virtual Network).

Main features of Azure API Management

The API gateway is the endpoint that :-

  1. Accepts API calls and routes them to your backends.
  2. Verifies API keys, JWT tokens, certificates, and other credentials.
  3. Enforces usage quotas and rate limits.
  4. Transforms your API on the fly without code modifications.
  5. Caches backend responses where set up.
  6. Logs call metadata for analytics purposes.

Now, let’s discuss about AGW and API-M integration to gain intended security

Combining API Management provisioned in an internal VNET with the Application Gateway frontend enables the following scenarios:

  • Use the same API Management resource for consumption by both internal consumers and external consumers.
  • Use a single API Management resource and have a subset of APIs defined in API Management available for external consumers.
  • Provide a turn-key way to switch access to API Management from the public Internet on and off.

Below architecture demonstrates integration of AGW and API-M. It highlights couple of key components like below…

  • API Management deployed in “internal” VNET mode.
  • Application Gateway (WAF) for exposing a subset of API’s externally.

Figure #3: Integration of AGW and API-M – High level architecture only

Now the question arises in your mind is, how are the API’s segregated so that only the ones deemed “external” are accessible via the Internet? Is it configured on API-M or the App Gateway?

It turns out the solution is a combination of both and is relatively simple…

  • Within API-M, APIs are created with separate base URL’s like /external and /internal
  • Within AGW, a path-based routing rule is created that redirects any API requests that contain /external to the API-M backend.
  • The same routing rule drops requests to any other API requests containing /internal.

While API-M provides the ability to whitelist specific source IP addresses, the benefit of this architecture is that non-permitted API requests are blocked at the perimeter of your network as depicted below.

Figure #4: Shows APIs security through AGW and API-M integration (Internal API calls v/s external internet facing API calls + how they are deployed and protected)

Microsoft has a supported blueprint for above scenario, which basically covers below implementation topics. Hence consider to read through this blueprint to understand the implementation steps in details…

  • How to use a single API Management service for both internal and external consumers and make it act as a single frontend for both on premises and cloud APIs.
  • You will also see how to expose only a subset of your APIs (in the example they are highlighted in green in figure #3 above) for external consumption using routing functionality available in Application Gateway.
  • All your APIs are managed only from within your Virtual Network. Internal consumers (highlighted in orange in figure #3 above) can access all your internal and external APIs. Hence, traffic never goes out to the internet.
  • However please note that, high performance connectivity is delivered via Express Route circuits.

+++ Must read about Garner Magic Quadrant regarding API-Management services +++

Microsoft is proven as a Leader in the 2020 Gartner Magic Quadrant for Full Life Cycle API Management. Facts to know about Azure API Management are…

  • API management is an essential component of digital transformation.
  • API management enables security management across clouds and on-premises.
  • It offers API discovery and onboarding.
  • It is possible to deploy API Management artifacts using popular DevOps solutions such as GitHub Actions.

21 thoughts on “How to implement security across internet facing APIs and organization’s internal APIs that are hosted in on-premise and Azure cloud?”

  1. Fantastic items from you, man. I’ve remember your stuff prior to and you are just too excellent. I really like what you’ve got here, really like what you’re saying and the way in which during which you assert it. You’re making it enjoyable and you continue to take care of to keep it smart. I cant wait to learn much more from you. That is really a great website.

  2. What i do not understood is actually how you are not really much more well-liked than you might be right now. You’re very intelligent. You realize therefore significantly relating to this subject, produced me personally consider it from numerous varied angles. Its like men and women aren’t fascinated unless it抯 one thing to accomplish with Lady gaga! Your own stuffs nice. Always maintain it up!

  3. Hello, i think that i saw you visited my blog thus i came to 搑eturn the favor?I’m trying to find things to improve my website!I suppose its ok to use some of your ideas!!

  4. Does your blog have a contact page? I’m having a tough time locating it but, I’d like to shoot you an e-mail. I’ve got some recommendations for your blog you might be interested in hearing. Either way, great blog and I look forward to seeing it grow over time.

  5. Heya i’m for the first time here. I found this board and I find It truly useful & it helped me out a lot. I hope to give something back and aid others like you aided me.

  6. I’m really enjoying the design and layout of your website. It’s a very easy on the eyes which makes it much more pleasant for me to come here and visit more often. Did you hire out a developer to create your theme? Superb work!

    1. Thanks for reading my blog. No I haven’t hired any developer to design themes. I myself coming from web design background and i have used WordPress in-built themes to design this website.

  7. Hello my friend! I want to say that this article is amazing,great written and include almost all significant infos.I would like to see more posts like this .

  9. hi!,I really like your writing so much! share we keep in touch extra about your post on AOL? I need a specialist on this house to unravel my problem. Maybe that is you! Looking ahead to peer you.

  11. With havin so much written content do you ever run into any issues of plagorism or copyright infringement? My website has a lot of unique content I’ve either created myself or outsourced but it appears a lot of it is popping it up all over the internet without my agreement. Do you know any ways to help prevent content from being stolen? I’d genuinely appreciate it.

    1. I don’t know how to protect our blog content from reusing. However i don’t bother it. I can see lot of duplicate contents in various blogs.!!!

  13. Great post. I used to be checking continuously this weblog and I am impressed! Very useful information specially the closing phase 🙂 I take care of such information a lot. I was seeking this particular information for a very long time. Thanks and best of luck.

Comments are closed.