azure-apim-architecture

Name: azure-apim-architecture
Author: thomast1906

11installs53forks

How to install azure-apim-architecture?

thomast1906/github-copilot-agent-skills/azure-apim-architecture

$npx -y skills add thomast1906/github-copilot-agent-skills --skill azure-apim-architecture

Installs into the current project.

Summary

Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost opt

Files · 1

View on GitHub

SKILL.md

1	# Azure APIM Architecture Skill
2
3	Provides comprehensive guidance on Azure API Management architecture patterns for enterprise API marketplaces, including component selection, network topology, cost optimization, and design decision rationale.
4
5	## When to Use This Skill
6
7	Activate this skill when users ask questions related to:
8
9	- Component selection: "Should I use Azure Front Door or Application Gateway?"
10	- Network architecture: "VNet Internal mode vs External mode?"
11	- Multi-environment strategy: "Separate APIM instances or workspaces for dev/test/prod?"
12	- Cost optimization: "How much will this cost in UK South?"
13	- Authentication patterns: "OAuth vs subscription keys for public APIs?"
14	- Design rationale: "Why did you choose X instead of Y?"
15
16	## Core Knowledge
17
18	### 1. Azure Front Door Premium (Not Application Gateway)
19
20	Decision: Use Azure Front Door Premium as ingress layer
21
22	Rationale:
23	- Built-in DDoS protection: Platform-level, included at no extra cost (saves £2,644/month vs separate Azure DDoS Standard)
24	- Private Link support: Secure backend connectivity to APIM VNet Internal mode without public internet exposure
25	- Global capabilities: Multi-POP network, future-proof for geographic expansion
26	- WAF included: Managed OWASP rulesets for application security
27	- Better for APIs: Optimized for HTTP/HTTPS routing, lower latency than App Gateway
28
29	Cost: £378/month (UK South) vs Application Gateway WAF v2 ~£350/month (similar cost, AFD offers more features)
30
31	Microsoft Docs: [Azure Front Door Overview](https://learn.microsoft.com/azure/frontdoor/front-door-overview)
32
33	Alternatives Rejected:
34	- Application Gateway: No global capabilities, requires separate DDoS (£2,644/mo), less optimized for API workloads
35	- Direct APIM exposure: Not secure, no DDoS protection layer
36
37	---
38
39	### 2. VNet Internal Mode (Not External)
40
41	Decision: Deploy all APIM instances in VNet Internal mode
42
43	Rationale:
44	- Maximum security: No public IP exposure, gateway endpoints accessible only within VNet via internal load balancer
45	- Zero-trust architecture: All external access via Front Door → Private Link → APIM internal endpoint (Azure backbone, no internet)
46	- Simplified attack surface: Only Front Door is internet-facing (single point of defense)
47	- Compliance: Meets data residency and security requirements (no data leaving Azure network)
48	- Internal API security: Private APIs accessible only within VNet without separate APIM instance
49
50	Microsoft Guidance:
51	> "Use the internal VNet mode when you want to expose your API Management instance only to clients within the VNet. This mode provides maximum security by ensuring the gateway and management endpoints are accessible only via private IPs." - [APIM VNet Modes](https://learn.microsoft.com/azure/api-management/api-management-using-with-vnet?tabs=stv2#virtual-network-modes)
52
53	Network Flow:
54	```
55	Internet User → Azure Front Door (WAF, DDoS)
56	↓ Private Link (Azure backbone, no internet)
57	APIM Internal Endpoint (10.1.1.4, no public IP)
58	↓ VNet connectivity
59	Backend APIs (within VNet or peered VNets)
60	```
61
62	Key Implications:
63	- Gateway endpoint: `10.1.1.4` (internal IP only, not registered in public DNS)
64	- Developer portal: Accessed via VNet or Front Door with Private Link
65	- Management endpoint: Requires VPN/Bastion or Azure portal (no public access)
66	- Private DNS zones: `azure-api.net` resolves to internal IP within VNet
67	- Warning: Complexity: Requires proper VNet configuration, Private DNS setup, Private Link approval
68
69	External Mode Rejected:
70	- Gateway has public IP (even if restricted by NSGs)
71	- Larger attack surface
72	- Cannot enforce 100% private traffic flow
73
74	Microsoft Docs: [APIM VNet Integration](https://learn.microsoft.com/azure/api-management/api-management-using-with-vnet)
75
76	---
77
78	### 3. Separate APIM Instances per Environment (Not Workspaces)
79
80	Decision: Use 3 separate APIM instances for dev/test/prod, not workspaces within a single instance
81
82	Rationale:
83	- Cost optimization: Developer tier for dev/test (£45/month) vs Premium shared cost (£648/workspace if conceptually split)
84	- Blast radius isolation: Dev changes cannot impact production (separate compute, configuration, secrets, networking)
85	- Independent scaling: Scale prod (3 units zone-redundant)

People who liked this also viewed

6 picks

Type

azure-apim-architecture

11installs53forks

View on GitHub

How to install azure-apim-architecture?

thomast1906/github-copilot-agent-skills/azure-apim-architecture

$npx -y skills add thomast1906/github-copilot-agent-skills --skill azure-apim-architecture

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure APIM Architecture Skill
2
3	Provides comprehensive guidance on Azure API Management architecture patterns for enterprise API marketplaces, including component selection, network topology, cost optimization, and design decision rationale.
4
5	## When to Use This Skill
6
7	Activate this skill when users ask questions related to:
8
9	- Component selection: "Should I use Azure Front Door or Application Gateway?"
10	- Network architecture: "VNet Internal mode vs External mode?"
11	- Multi-environment strategy: "Separate APIM instances or workspaces for dev/test/prod?"
12	- Cost optimization: "How much will this cost in UK South?"
13	- Authentication patterns: "OAuth vs subscription keys for public APIs?"
14	- Design rationale: "Why did you choose X instead of Y?"
15
16	## Core Knowledge
17
18	### 1. Azure Front Door Premium (Not Application Gateway)
19
20	Decision: Use Azure Front Door Premium as ingress layer
21
22	Rationale:
23	- Built-in DDoS protection: Platform-level, included at no extra cost (saves £2,644/month vs separate Azure DDoS Standard)
24	- Private Link support: Secure backend connectivity to APIM VNet Internal mode without public internet exposure
25	- Global capabilities: Multi-POP network, future-proof for geographic expansion
26	- WAF included: Managed OWASP rulesets for application security
27	- Better for APIs: Optimized for HTTP/HTTPS routing, lower latency than App Gateway
28
29	Cost: £378/month (UK South) vs Application Gateway WAF v2 ~£350/month (similar cost, AFD offers more features)
30
31	Microsoft Docs: [Azure Front Door Overview](https://learn.microsoft.com/azure/frontdoor/front-door-overview)
32
33	Alternatives Rejected:
34	- Application Gateway: No global capabilities, requires separate DDoS (£2,644/mo), less optimized for API workloads
35	- Direct APIM exposure: Not secure, no DDoS protection layer
36
37	---
38
39	### 2. VNet Internal Mode (Not External)
40
41	Decision: Deploy all APIM instances in VNet Internal mode
42
43	Rationale:
44	- Maximum security: No public IP exposure, gateway endpoints accessible only within VNet via internal load balancer
45	- Zero-trust architecture: All external access via Front Door → Private Link → APIM internal endpoint (Azure backbone, no internet)
46	- Simplified attack surface: Only Front Door is internet-facing (single point of defense)
47	- Compliance: Meets data residency and security requirements (no data leaving Azure network)
48	- Internal API security: Private APIs accessible only within VNet without separate APIM instance
49
50	Microsoft Guidance:
51	> "Use the internal VNet mode when you want to expose your API Management instance only to clients within the VNet. This mode provides maximum security by ensuring the gateway and management endpoints are accessible only via private IPs." - [APIM VNet Modes](https://learn.microsoft.com/azure/api-management/api-management-using-with-vnet?tabs=stv2#virtual-network-modes)
52
53	Network Flow:
54	```
55	Internet User → Azure Front Door (WAF, DDoS)
56	↓ Private Link (Azure backbone, no internet)
57	APIM Internal Endpoint (10.1.1.4, no public IP)
58	↓ VNet connectivity
59	Backend APIs (within VNet or peered VNets)
60	```
61
62	Key Implications:
63	- Gateway endpoint: `10.1.1.4` (internal IP only, not registered in public DNS)
64	- Developer portal: Accessed via VNet or Front Door with Private Link
65	- Management endpoint: Requires VPN/Bastion or Azure portal (no public access)
66	- Private DNS zones: `azure-api.net` resolves to internal IP within VNet
67	- Warning: Complexity: Requires proper VNet configuration, Private DNS setup, Private Link approval
68
69	External Mode Rejected:
70	- Gateway has public IP (even if restricted by NSGs)
71	- Larger attack surface
72	- Cannot enforce 100% private traffic flow
73
74	Microsoft Docs: [APIM VNet Integration](https://learn.microsoft.com/azure/api-management/api-management-using-with-vnet)
75
76	---
77
78	### 3. Separate APIM Instances per Environment (Not Workspaces)
79
80	Decision: Use 3 separate APIM instances for dev/test/prod, not workspaces within a single instance
81
82	Rationale:
83	- Cost optimization: Developer tier for dev/test (£45/month) vs Premium shared cost (£648/workspace if conceptually split)
84	- Blast radius isolation: Dev changes cannot impact production (separate compute, configuration, secrets, networking)
85	- Independent scaling: Scale prod (3 units zone-redundant)

People who liked this also viewed

6 picks

Type