We're deploying several applications that need an API gateway. One option is to place Azure API Management and the WAF in the shared hub, then expose or reach the endpoints through an FQDN over virtual network peering. Since we don't have a large number of applications, what is generally the better architecture: a shared APIM deployment in the hub, or a separate APIM instance in each application spoke?
2 Answers
Putting APIM in the hub can also work, especially when the API gateway or Application Gateway is shared by several applications. If the application team owns a gateway dedicated to one application, placing it in that application’s spoke usually makes more sense.
The decision mainly depends on ownership and sharing. Use the hub for centrally managed, shared gateway infrastructure. Use a dedicated spoke when a specific application team manages the gateway or when you want stronger isolation and simpler traffic control. If you adopt an Azure Virtual WAN architecture, infrastructure generally needs to be placed in a spoke rather than directly in the managed hub.
If APIM is deployed in the hub behind Application Gateway, would it normally be configured as internal APIM rather than external APIM?