API Management should be integrated with a Virtual Network

Medium Azure General service-api-management-integrated-virtual

Applies to

Microsoft.ApiManagement/service

What CGPulse checks

A resource passes this rule when virtualNetworkType must be one of ["External","Internal"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Integrate with a Virtual Network to route traffic privately and reduce internet exposure. In Azure Portal: API Management > Networking > configure VNet integration. See: https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts

CLI

az apim show --ids "{id}" --query "virtualNetworkType" -o tsv

Bicep

// Note: Requires Developer or Premium SKU

param subnetId string

resource apim 'Microsoft.ApiManagement/service@2023-09-01-preview' existing = {{
  name: '{name}'
}}
// TODO: Update virtualNetworkType to 'External' or 'Internal' and configure subnetResourceId

Terraform

# VNet integration requires Developer or Premium SKU
resource "azurerm_api_management" "{name}" {
  name                 = "{name}"
  resource_group_name  = "{rg}"
  location             = var.location
  publisher_name       = "My Company"
  publisher_email      = "admin@example.com"
  sku_name             = "Premium_1"
  virtual_network_type = "External"
  virtual_network_configuration {
    subnet_id = var.subnet_id
  }
}

Compliance frameworks

Cloud Security BaselineNS-2

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan