Add APIM Policies #377
Add APIM Policies #377
Conversation
...e/managementGroupTemplates/policyDefinitions/Compliant-APIManagementPolicySetDefinition.json
Show resolved
Hide resolved
| }, | ||
| { | ||
| "anyOf": [ | ||
| { |
There was a problem hiding this comment.
How would this work with the custom policy we have already included ("API Management services should use a virtual network")?
There was a problem hiding this comment.
This is more restricted and enforces to host the instance in Internal mode instead of allowing both Internal and External. I am assuming that by default the APIM instances in Corp should not be accessible from the internet. See link here.
If external access should be used they can host APIM in Internal mode and connect it to an App GW.
There was a problem hiding this comment.
Do we have to distinguish at this level? Remember that this policySetDefinition will be assigned broadly at the LZ scope and apply to both cloud-native and corp connected. @victorar - any input from your PoV wrt to the other policies we have for APIM related to networking?
There was a problem hiding this comment.
I will follow your guidance and understand the concerns.
If we enforce this for corp and online Landing Zones, we should still be fine. Corp use-cases will then be able to rely on private endpoints whereas online landing zones can use an App GW with WAF and Public IP to accept public traffic.
Looking forward to your input @victorar and will remove it if it is too restrictive.
There was a problem hiding this comment.
Please let me know how to continue here.
...e/managementGroupTemplates/policyDefinitions/Compliant-APIManagementPolicySetDefinition.json
Outdated
Show resolved
Hide resolved
|
|
…ft/industry into marvinbuss/apim_policies
* Add Azure Storage Policies * Fix minor bug * Update type * Add policy for CORS rules * Add policy for CMK for encryption scopes * Remove policy for encryption scope * Update display name * Add list of allowed values for policy definition * Update policy for encryption * Add policy assignments * Removed policy for cross tenant PEs * Add missing parameters * Update mg name
|
Ready to be merged |
Summary of the Pull Request
PR Checklist
Validation Steps Performed