Azure API Management Restrict multiple caller IP Address API in API endpoint level

1
votes

I wanted to restrict some IP's in Azure APIM policy level.

I went thro below links; https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#RestrictCallerIPs

Azure API Management Restrict multiple caller IP Address

But not sure how can I do this to API end-point level using policy scope

I have below code in the policy.xml:

<policies>
    <inbound>
        <base />
        <!-- statements to be applied to the request go here -->
        <authentication-certificate thumbprint="@((string)context.Variables[&quot;ClientCertificateThumbprint&quot;])" />
        <rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.Headers.GetValueOrDefault(&quot;Ocp-Apim-Subscription-Key&quot;))" />        
        <cors>
            <allowed-origins>
                <origin>*</origin>
            </allowed-origins>
            <allowed-methods preflight-result-max-age="600">
                <method>*</method>
            </allowed-methods>
            <allowed-headers>
                <header>*</header>
            </allowed-headers>
            <expose-headers>
                <header>*</header>
            </expose-headers>
        </cors>
        <ip-filter action="allow">
          <address>55.11.187.20</address>
          <address-range from="186.168.95.0" to="186.168.95.20" />
        </ip-filter>
    </inbound>
    <backend>
        <base />

        <!-- statements to be applied before the request is forwarded to 
         the backend service go here -->
    </backend>
    <outbound>
        <base />

        <!-- statements to be applied to the response go here -->
    </outbound>
    <on-error>
        <base />
        <!-- statements to be applied if there is an error condition go here -->
    </on-error>
</policies

>

2
azure-api-management

2 Answers

2
votes

Using control flow in Advanced policies you can change the scope to API endpoint level (operation) to restrict IP addresses as below

<choose>
      <when condition="@(context.Operation.Id.Equals(&quot;StatusGet&quot;))">
        <ip-filter action="allow">
          <address>55.11.187.20</address>
           <address-range from="186.168.95.0" to="186.168.95.20" />
        </ip-filter>
      </when>
    </choose>
</inbound>

Refer: https://docs.microsoft.com/en-us/azure/api-management/api-management-advanced-policies

1
votes
  1. Navigate to Azure portal, your APIM service, APIs.
  2. Click API you want to apply IP filter to
  3. In the "Inbound processing" section click "Add policy" and select IP filter.