Securing free API App Service behind consumption API Management

Question

I have created a .NET Core API and deployed it as an App Service in Azure. On top of that, I have an instance of Azure API Management. Now I want the API to be only accessible through the APIM.

During the free testing phase, i restricted the access to the API to the IP of the APIM. As i do not expect my API to have high traffic and to save costs, i now switched to free and consumption tier.

As my APIM uses the consumption tier, there is no static IP that I could use to restrict the API access. As my App Service uses a free plan, neither VNet Integration nor incoming client certificates are available.

Is there are a way to secure a free App Service API with a APIM in consumption tier with Azure except from implementing it myself?

Answer 1

You have a few options with Consumption SKU in mind:

1. Basic auth - make APIM send a well known secret and check for that secret in API App.
2. Client certificate authentication - make APIM use client cert to connect to API App and check for it there.