apim_checklist.en.json

{
    "$schema": "checklist.schema.json",
    "items": [
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "service": "APIM",
            "waf": "Operations",
            "text": "Implement an error handling policy at the global level",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies"
        },
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "service": "APIM",
            "waf": "Operations",
            "text": "Ensure all APIs policies include a <base/> element.",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order"
        },
        {
            "category": "Governance",
            "subcategory": "Development best practices",
            "service": "APIM",
            "waf": "Operations",
            "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments"
        },
        {
            "category": "Governance",
            "subcategory": "Monetization",
            "service": "APIM",
            "waf": "Operations",
            "text": "If you are planning to monetize your APIs, review the 'monetization support' article for best practices",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "service": "APIM",
            "waf": "Operations",
            "text": "Enable Diagnostics Settings to export logs to Azure Monitor",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "service": "APIM",
            "waf": "Operations",
            "text": "Enable Application Insights for more detailed telemetry",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights"
        },
        {
            "category": "Governance",
            "subcategory": "Monitoring",
            "service": "APIM",
            "waf": "Operations",
            "text": "Configure alerts on the most critical metrics",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Data protection",
            "service": "APIM",
            "waf": "Security",
            "text": "Ensure that custom SSL certificates are stored an Azure Key Vault so they can be securely accessed and updated",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "service": "APIM",
            "waf": "Security",
            "text": "Protect incoming requests to APIs (data plane) with Azure AD",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Identity",
            "service": "APIM",
            "waf": "Security",
            "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad"
        },
        {
            "category": "Identity and Access Management",
            "subcategory": "Privileged access",
            "service": "APIM",
            "waf": "Security",
            "text": "Create appropriate groups to control the visibility of the products",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups"
        },
        {
            "category": "Management",
            "subcategory": "Best practices",
            "text": "Use Backends feature to eliminate redundant API backend configurations",
            "waf": "Operations",
            "service": "APIM",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/backends"
        },
        {
            "category": "Management",
            "subcategory": "Best practices",
            "text": "Use Named Values to store common values that can be used in policies",
            "service": "APIM",
            "waf": "Operations",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA",
            "service": "APIM",
            "waf": "Reliability",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = ( sku.name == 'Premium' and  isnotnull(properties.additionalLocations)) | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "Deploy at least one unit in two or more availability zones for an increased SLA of 99.99%",
            "service": "APIM",
            "waf": "Reliability",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = ( sku.name == 'Premium' and  isnotnull(zones) and sku.capacity >= 2 ) | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability"
        },
        {
            "category": "Management",
            "subcategory": "Business continuity and disaster recovery",
            "text": "Ensure there is an automated backup routine",
            "service": "APIM",
            "waf": "Reliability",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability"
        },
        {
            "category": "Management",
            "subcategory": "Failover and Caching",
            "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.",
            "waf": "Reliability",
            "service": "APIM",
            "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/retry-policy"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Consider using a external cache policy for APIs that can benefit from caching",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "service": "APIM",
            "waf": "Operations",
            "text": "If you need to log at high performance levels, consider Event Hubs policy",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "text": "Apply throttling policies to control the number of requests per second",
            "service": "APIM",
            "waf": "Performance",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "service": "APIM",
            "waf": "Performance",
            "text": "Configure autoscaling to scale out the number of instances when the load increases",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | join kind = leftouter (resources | where type == 'microsoft.insights/autoscalesettings' | extend targetResourceUri = tostring(properties.targetResourceUri)) on $left.id == $right.targetResourceUri | extend compliant = (sku.name == 'Premium' and isnotempty(targetResourceUri) and properties1.enabled == true) | distinct id, compliant",            
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale"
        },
        {
            "category": "Management",
            "subcategory": "Performance and scalability",
            "waf": "Performance",
            "service": "APIM",
            "text": "Deploy self-hosted gateways where Azure doesn't have a region close to the backend APIs.",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway"
        },
        {
            "category": "Management",
            "subcategory": "Premium Tier",
            "text": "Use the premium tier for production workloads.",
            "waf": "Reliability",
            "service": "APIM",
            "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale"
        },
        {
            "category": "Management",
            "subcategory": "Request Routing",
            "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.",
            "waf": "Reliability",
            "service": "APIM",
            "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services"
        },
        {
            "category": "Management",
            "subcategory": "Resource Limits",
            "text": "Be aware of APIM's limits",
            "waf": "Reliability",
            "service": "APIM",
            "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits"
        },
        {
            "category": "Management",
            "subcategory": "Platform Version",
            "text": "Upgrade the platform version and follow lifecyle. stv1 is retirng on 31 August 2024",
            "waf": "Reliability",
            "service": "APIM",
            "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8ce",
            "severity": "High",
            "graph": "resources | where type =~ 'microsoft.apimanagement/service' | extend compliant = (properties.platformVersion != 'stv1') | project id, compliant",
            "link": "https://learn.microsoft.com/en-us/azure/api-management/migrate-stv1-to-stv2"
        },
        {
            "category": "Management",
            "subcategory": "Self-Hosted",
            "text": "Ensure that the self-hosted gateway deployments are resilient.",
            "service": "APIM",
            "waf": "Reliability",
            "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
            "severity": "High",
            "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Connectivity",
            "service": "APIM",
            "waf": "Performance",
            "text": "Use Azure Front Door in front of APIM for multi-region deployment",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "service": "APIM",
            "waf": "Security",
            "text": "Deploy the service within a Virtual Network (VNet)",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = (isnotnull(properties.virtualNetworkConfiguration)) | distinct id, compliant",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "service": "APIM",
            "waf": "Security",
            "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "service": "APIM",
            "waf": "Security",
            "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = (properties.virtualNetworkType == 'None' and isnotnull(properties.privateEndpointConnections)) | distinct id, compliant",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link"
        },
        {
            "category": "Network Topology and Connectivity",
            "subcategory": "Security",
            "service": "APIM",
            "waf": "Security",
            "text": "Disable Public Network Access",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "severity": "High",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = (properties.virtualNetworkType == 'Internal') | distinct id, compliant",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Automation",
            "service": "APIM",
            "waf": "Operations",
            "text": "Simplify management with PowerShell automation scripts",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Best practices",
            "service": "APIM",
            "waf": "Operations",
            "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "Best practices",
            "service": "APIM",
            "waf": "Operations",
            "text": "Promote usage of Visual Studio Code APIM extension for faster API development",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial"
        },
        {
            "category": "Platform automation and DevOps",
            "subcategory": "DevOps",
            "service": "APIM",
            "waf": "Operations",
            "text": "Implement DevOps and CI/CD in your workflow",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "service": "APIM",
            "waf": "Security",
            "text": "Secure APIs using client certificate authentication",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "service": "APIM",
            "waf": "Security",
            "text": "Secure backend services using client certificate authentication",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "service": "APIM",
            "waf": "Security",
            "text": "Review 'Recommendations to mitigate OWASP API Security Top 10 threats' article and check what is applicable to your APIs",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats"
        },
        {
            "category": "Security",
            "subcategory": "APIs",
            "service": "APIM",
            "waf": "Security",
            "text": "Use Authorizations feature to simplify management of OAuth 2.0 token for your backend APIs",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview"
        },
        {
            "category": "Security",
            "subcategory": "Ciphers",
            "service": "APIM",
            "waf": "Security",
            "text": "Use the latest TLS version when encrypting information in transit. Disable outdated and unnecessary protocols and ciphers when possible.",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers"
        },
        {
            "category": "Security",
            "subcategory": "Data protection",
            "service": "APIM",
            "waf": "Security",
            "text": "Ensure that secrets (Named values) are stored an Azure Key Vault so they can be securely accessed and updated",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets"
        },
        {
            "category": "Security",
            "subcategory": "Identities",
            "service": "APIM",
            "waf": "Security",
            "text": "Use managed identities to authenticate to other Azure resources whenever possible",
            "guid": "791abd8b-7706-4e31-9569-afefde724be3",
            "severity": "Medium",
            "graph": "resources | where type == 'microsoft.apimanagement/service' | extend compliant = (isnotnull(identity)) | distinct id, compliant",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities"
        },
        {
            "category": "Security",
            "subcategory": "Network",
            "service": "APIM",
            "waf": "Security",
            "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "severity": "High",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall"
        }
    ],
    "categories": [
        {
            "name": "Identity and Access Management"
        },
        {
            "name": "Network Topology and Connectivity"
        },
        {
            "name": "Security"
        },
        {
            "name": "Management"
        },
        {
            "name": "Governance"
        },
        {
            "name": "Platform automation and DevOps"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "Not required",
            "description": "Recommendation understood, but not needed by current requirements"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "waf": [
        {
            "name": "Reliability"
        },
        {
            "name": "Security"
        },
        {
            "name": "Cost"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Performance"
        }
    ],
    "yesno": [
        {
            "name": "Yes"
        },
        {
            "name": "No"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review",
        "timestamp": "June 10, 2024",
        "waf": "all",
        "state": "GA"
    }
}