You are configuring policies in Azure API Management (APIM) to expose an internal backend REST service hosted on Azure App Service. The backend service requires Microsoft Entra ID authentication and expects a token with the audience https://api.contoso.com.
The API gateway must satisfy the following requirements:
1. Authenticate to the backend App Service using the APIM instance's system-assigned managed identity.
2. Limit the incoming request rate to no more than 100 calls per 60 seconds per individual client IP address to prevent denial-of-service attempts.
Which of the following policy configurations correctly meets these requirements?
- <policies>
<inbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
<authentication-managed-identity resource="https://api.contoso.com" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies>Cevap - B<policies>
<inbound>
<base />
<rate-limit calls="100" renewal-period="60" />
<authentication-managed-identity resource="https://api.contoso.com" client-id="3f2504e0-4f89-11d3-9a0c-0305e82c3301" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies> - C<policies>
<inbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<authentication-managed-identity resource="https://api.contoso.com" />
</outbound>
<on-error>
<base />
</on-error>
</policies> - D<policies>
<inbound>
<base />
<authentication-managed-identity resource="https://api.contoso.com" />
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.IpAddress)" />
</outbound>
<on-error>
<base />
</on-error>
</policies>
Cevap
The correct configuration applies both the rate-limit-by-key policy (using the client's IP address) and the authentication-managed-identity policy (omitting client-id to default to system-assigned identity) within the inbound section of the API policy definition.
The correct configuration applies both the rate-limit-by-key policy and the authentication-managed-identity policy in the inbound section. The rate-limit-by-key policy restricts calls per client IP using context.Request.IpAddress, and omitting client-id in authentication-managed-identity ensures the system-assigned managed identity is used.
Adım Adım Çözüm
Anahtar Kavram
API Management policies must be placed in the appropriate evaluation section (inbound vs outbound), and the correct attributes must be supplied to distinguish between system-assigned managed identity and user-assigned managed identity, as well as subscription-based and IP-based rate limiting.