Should Azure API Management and WAF live in the hub or a dedicated spoke?
Asked by
MellowPine42
We're deploying several applications that need an API gateway. We're considering placing Azure API Management and the WAF in the hub, then reaching the application endpoints through fully qualified domain names and VNet peering. Since we only have a small number of applications, would it be better to centralize APIM in the hub, or should each application's spoke have its own APIM instance?
Answers
A dedicated spoke is usually a clean option. It keeps APIM isolated from the central hub and gives you more control over routing, security rules, and ownership.
Reply to this answer
The right location mainly depends on how the gateway is shared. A shared Application Gateway and APIM instance fit naturally in the hub, while application-specific gateways are better kept in the relevant spoke. A separate APIM spoke is another good compromise because it avoids placing application resources directly in the hub while still centralizing the API platform. If you later use Azure Virtual WAN, plan for a dedicated spoke because workloads cannot be deployed directly into the Virtual WAN hub.
Reply to this answer
Putting APIM in the hub can also work, especially when the gateway is shared by multiple applications. If each application team owns a dedicated Application Gateway and APIM setup, placing those resources in that application’s spoke is generally more appropriate.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine42: If APIM is deployed in the hub behind Application Gateway, would it normally use the internal mode rather than the external mode?