6.1.1.2. Implement API Policies

First Principle: Azure API Management (APIM) policies are configuration-driven statements that modify API request and response behavior. Policies are executed sequentially and enable powerful, code-free control over APIs, ensuring security, traffic management, and transformation.

What It Is: "APIM policies" are a collection of statements that are executed sequentially on the request or response of an API. They allow you to control traffic, enforce security, and transform data without changing backend code.

Visual: "APIM Policy Execution Pipeline"

Loading diagram...

Common Policy Categories & Examples:

• "Access Restriction":
  • ip-filter: Allow/deny traffic by IP address.
  • jwt-validation: Enforce "JWT (JSON Web Token)" authentication.
  • validate-header: Require specific headers to be present in the request.
  • limit-call-rate: Throttles requests based on calls per subscription or key.
• "Transformation":
  • set-header: Add or modify HTTP headers in requests or responses.
  • set-body: Change request/response body (e.g., convert XML to JSON).
  • find-and-replace: Search and replace content within the request or response body.
• "Caching":
  • cache-lookup, cache-store: Store/retrieve responses to boost performance and reduce load on backend services.
  • ↳ See: 5.1.1.
• "Flow Control":
  • rate-limit: Limit calls per time period per subscription or user.
  • quota: Enforce usage quotas (e.g., total calls per month).
• "Authentication":
  • authentication-managed-identity: Authenticate APIM to a backend service using a managed identity.

Policy Scopes: Policies can be applied at different levels of granularity:

• "Global": Applies to all APIs in the "APIM instance".
• "Product": Applies to all APIs within a "product".
• "API": Applies to every operation in a specific API.
• "Operation": Targets a single API operation (e.g., specific HTTP GET method).

Policy Execution Order: Policies are processed in a defined sequence at different stages of the request/response flow:

1. "Inbound": Policies executed before the request is sent to the backend service.
2. "Backend": Policies executed between "APIM" and the backend service (e.g., to transform request headers).
3. "Outbound": Policies executed before the response is sent back to the client.
4. "On-error": Policies executed if an error occurs during processing.

Scenario: You need to protect a public API from abuse by limiting external consumers to 100 calls per minute. You also need to ensure that specific HTTP headers are always present in the requests before they are forwarded to your backend service.

Reflection Question: How do Azure API Management policies, through their various categories (access restriction, transformation, caching, flow control) and customizable scopes, fundamentally enable powerful, code-free control over APIs, ensuring security, traffic management, and transformation without modifying backend code?