1. Answers
  2. Restricting API Access to Specific IP Ranges with Azure API Management Policies

How do I restrict API access to specific IP ranges with Azure API Management policies?

In this guide, we will implement a policy in Azure API Management to restrict access to specific IP ranges. Policies in API Management are a collection of statements that are executed sequentially on the request or response of an API. Using these policies, administrators can control the behavior of the APIs.

We will define an API Management resource and apply a policy to restrict access to specific IP ranges. The defined IP ranges will be allowed to access the API, while others will be denied.

Below is an example program to achieve this:

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const example = new azure.core.ResourceGroup("example", {
    name: "example-resources",
    location: "West Europe",
});
const exampleService = new azure.apimanagement.Service("example", {
    name: "example-apim",
    location: example.location,
    resourceGroupName: example.name,
    publisherName: "MyCompany",
    publisherEmail: "company@example.com",
    skuName: "Developer_1",
});
const exampleApi = new azure.apimanagement.Api("example", {
    name: "example-api",
    resourceGroupName: example.name,
    apiManagementName: exampleService.name,
    revision: "1",
    displayName: "Example API",
    path: "example",
    protocols: ["https"],
});
const exampleApiPolicy = new azure.apimanagement.ApiPolicy("example", {
    apiName: exampleApi.name,
    apiManagementName: exampleService.name,
    resourceGroupName: example.name,
    xmlContent: `  <policies>
      <inbound>
          <base />
          <check-header header-name="x-forwarded-for" failed-check-httpcode="403">
              <ip-filter action="allow">
                  <address>203.0.113.0/24</address>
                  <address>198.51.100.0/24</address>
              </ip-filter>
          </check-header>
      </inbound>
      <backend>
          <base />
      </backend>
      <outbound>
          <base />
      </outbound>
      <on-error>
          <base />
      </on-error>
  </policies>
`,
});
export const apimName = exampleService.name;
export const apiId = exampleApi.id;

In this program:

  1. We start by defining the Azure provider to interact with Azure resources.
  2. We create a resource group to hold all of our resources.
  3. An API Management instance is set up within this resource group.
  4. We define an API within the API Management instance and specify its basic details.
  5. We then apply a policy to the API to restrict access based on the provided IP ranges.
  6. Finally, we output the name of the API Management instance and the API ID.

In conclusion, we have set up an Azure API Management instance with an API that restricts access to specific IP ranges using an IP filter policy. This setup ensures that only requests from the provided IP ranges are allowed, enhancing the security of your APIs.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

Sign up

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.

Sign up